What Sintropyc tests
Sintropyc is an autonomous AI penetration testing agent that proves every finding with a working exploit and a fix. Here is what it tests, by vulnerability class — each page covers how the flaw works, how we prove it, and how to close it.
Access control & authorization
IDOR testingIDOR is when changing an ID in a request lets you read or modify another user's data.BOLA testingBOLA — Broken Object Level Authorization, number one on the OWASP API Top 10 — is when an API returns an object without checking the caller owns it.Broken access controlBroken access control (OWASP #1 for web) is when users do or see things their role shouldn't allow.API authorization testingAPI authorization testing verifies every endpoint enforces who can do what — object-level (BOLA), function-level (admin routes) and property-level (mass assignment).Mass assignment testingMass assignment is when an API blindly binds request fields to your data model, letting a user set fields like role=admin or is_verified=true.Tenant isolation testingIn multi-tenant SaaS, tenant isolation means one customer can never reach another's data.
Injection & code execution
SQL injection testingSQL injection lets an attacker read or change your database through an app input.Command injectionOS command injection lets an attacker run shell commands on your server: full remote code execution.SSTI testingServer-side template injection (SSTI) turns a template into a code-execution primitive, often full RCE.XXE injectionXXE abuses an XML parser to read local files, reach internal services (SSRF) or exfiltrate data out-of-band.Path traversal & LFIPath traversal lets an attacker step outside the intended directory to read (or include) files like /etc/passwd or your app config.
Client-side & request forgery
XSS testingCross-site scripting (XSS) lets an attacker run JavaScript in your users' browsers.CSRF testingCSRF tricks a logged-in user's browser into making an unwanted state-changing request.Open redirect testingAn open redirect lets an attacker use your trusted domain to bounce users to a malicious site, powering phishing and OAuth token theft.SSRF testingServer-side request forgery (SSRF) tricks your server into making requests an attacker controls, reaching internal services or cloud metadata.
Auth, secrets & logic
Authentication testingBroken authentication lets attackers become someone else: weak sessions, guessable resets, missing MFA checks, no rate limiting.JWT security testingJSON Web Tokens carry identity and permissions, and a weak one is instant account takeover.Exposed secretsLeaked API keys, tokens and credentials in your JS bundles, responses or repos are instant compromise, if they're still live.Supabase security auditA Supabase security audit checks that Row Level Security is enabled and correct on every exposed table, that your keys aren't over-privileged, and that Storage, Edge Functions and Realtime never leak data across users.Business logic testingBusiness logic flaws are valid requests that break your rules: skipping payment, replaying discounts, negative quantities, jumping a workflow step.