Blackbox vs. Whitebox
Two ways to test a target, and how to pick between them.
Every Vulnix scope is one of two scan types. They're not tiers of the same thing — they exercise the agent differently, produce different kinds of findings, and are priced differently.
Prop
Type
Blackbox
You point Vulnix at a live web or API asset you've already verified you own — verification, not a signed authorization form, is what gates whether a run against that domain can start at all. The agent then tests it the way an external attacker would: no source access, no internal context, just what's actually reachable over the network.
Verification methods
A DNS TXT record, an uploaded file, or a meta tag — pick whichever fits how the domain is hosted. If it's on Cloudflare or Vercel, connect that provider via OAuth instead and Vulnix creates the DNS record for you, no copy-pasting required. See Domains & Verification for the full walkthrough.
Blackbox scans come in two modes:
- Quick — the mode every trial organization's one-time credit grant is sized for exactly.
- Deep — a more thorough pass, available on any paid plan.
Whitebox
You connect a GitHub repository instead. Vulnix clones it into the sandbox and tests the source directly — with access to context an external attacker never has, so findings can point at an exact file and line, and an eligible finding can get a real GitHub pull request opened against it with the fix already applied.
Requires a paid plan
Unlike blackbox scanning, Whitebox is never available on the trial plan — see Billing & Credits for current pricing.
A repository can also be enrolled in automatic PR review independently of running a full Whitebox pentest against it — see GitHub Integration for how that works.
Combined targets
A Whitebox scope can also carry a verified domain target. When it does, the agent attacks the live target in addition to reviewing the source — priced at $225 instead of the source-only $150, reflecting the extra work.
Which one should I run first?
