Blackbox vs. Whitebox
Two ways to test a target, and how to pick between them.
Every Vulnix scope is one of two scan types. They're not tiers of the same thing — they exercise the agent differently, produce different kinds of findings, and are priced differently.
Prop
Type
Blackbox
You point Vulnix at a live web app or API on a domain you've verified you own, or at a public IP range. For a domain, verification, not a signed authorization form, is what gates whether a run against it can start at all. An IP range can't be verified that way (see below), so test only ranges you own. The agent then tests it the way an external attacker would: no source access, no internal context, just what's actually reachable over the network.
An IP-range target (a single public IP or a CIDR block like 203.0.113.0/24) is port- and
service-scanned: the agent maps exposed services, fingerprints them, and checks each for known
CVEs and misconfigurations. This is external, internet-facing infrastructure testing only —
private/RFC-1918 ranges (10.0.0.0/8, 192.168.0.0/16, …), loopback, and cloud-metadata
addresses are rejected when you add the target, and Active Directory is out of scope.
Verification methods
A DNS TXT record, an uploaded file, or a meta tag — pick whichever fits how the domain is hosted. If it's on Cloudflare or Vercel, connect that provider via OAuth instead and Vulnix creates the DNS record for you, no copy-pasting required. See Domains & Verification for the full walkthrough.
A public IP range has no place to host a proof file or record, so it can't be ownership-verified the same way — instead it's restricted to public, externally-routable addresses at input time.
Every blackbox pentest runs at full depth, on every plan.
Whitebox
You connect a GitHub repository instead. Vulnix clones it into the sandbox and tests the source directly — with access to context an external attacker never has, so findings can point at an exact file and line, and an eligible finding can get a real GitHub pull request opened against it with the fix already applied.
Same price as blackbox
A whitebox pentest uses one pentest from your plan, the same as a blackbox one — see Billing & Plans.
A repository can also be enrolled in automatic PR review independently of running a full Whitebox pentest against it — see GitHub Integration for how that works.
Combined targets
A Whitebox scope can also carry a verified domain target. When it does, the agent attacks the live target in addition to reviewing the source. It still counts as one pentest.
Which one should I run first?
