Glossary
The vocabulary this documentation uses throughout.
Agent trace
The live, then permanent, record of what the pentesting agent actually did during a run: every sub-agent it spawned, every tool it called, and why — rendered as an interactive graph, not a flat log.
Blackbox
A scan against a live web app, API, or public IP range, tested over the network the way an external attacker would, with no source access. An IP-range target is port- and service-scanned; private/internal ranges are out of scope. See Blackbox vs. Whitebox.
Domain
A verified web/API asset that can be used as a Blackbox target. See Domains & Verification.
Finding
A single verified vulnerability discovered during a run — carries a severity, evidence, and (for a Whitebox finding) an exact code location. See Findings & Reports.
Fix PR
A real GitHub pull request Vulnix can open for an eligible Whitebox finding, with the engine's suggested fix already applied — a manual, per-finding action.
Knowledge
Org-level context about your application — business logic, critical assets, testing rules, tech stack, accepted risks — written once and applied automatically to every run whose targets match, instead of retyped per pentest. See Knowledge & Context.
Learned knowledge
The half of Knowledge that Vulnix writes itself: what the agent worked out about your application during a pentest, kept for later runs. Read-only — you can delete an entry but not edit it.
PR review
An automated, diff-scoped review Vulnix runs against a qualifying pull request on a connected repository, posted as a real GitHub Review. See GitHub Integration.
Run
A single execution of a scope — the unit that actually uses a pentest, produces findings, and generates a report.
Sandbox
The isolated environment a run executes in, torn down when the run ends. See Security & Trust.
Scope
The reusable configuration a run is launched from: scan type, scan mode, exclusions, and any saved credentials or headers. See Scoping a Run.
Free
The plan every new organization starts on: one pentest, once, and 5 PR reviews a month. See Billing & Plans.
Validate Fix
A narrowly-scoped re-run that replays a finding's exact original exploit to confirm a fix actually holds, before you close the finding out.
Whitebox
A scan against a connected source repository, cloned into the sandbox and tested directly. See Blackbox vs. Whitebox.
