Find weaknesses.
Examine the boundaries between accounts, permissions and workflows, including actions or information a user should not be able to access.
BLACKWALL
In development
Security testing for the product you ship.
A planned service for founders and product teams. Blackwall will use authorized AI agents to test your website within an agreed scope, with evidence and practical next steps for your team.
Know what needs attention.
Understand impact.
See how an identified weakness was demonstrated, what it could affect, and which areas were tested or remain outside coverage.
Prioritize fixes.
Receive an agent-generated report with evidence, severity and suggested fixes to help your team decide what to address first.
How assessments workAgreed scope, authorized testing and a report.
Agree the scope.
Discuss the features, test accounts, permissions and workflows to examine, with explicit authorization, access and boundaries agreed before testing.
Run the assessment.
Our team will use Citadel, our planned agent harness, to run and manage AI agents investigating the agreed areas. Duration and capacity follow the selected assessment and scope.
Review the findings.
Receive an agent-generated summary of findings, evidence, suggested fixes and untested areas. Support covers questions about the assessment and report. Additional testing requires a separate paid assessment.
Findings will distinguish confirmed weaknesses from investigative leads and demonstrated impact from possible impact. An assessment cannot guarantee every weakness will be found or certify a website as secure.
An illustrative findingA hypothetical example of the intended report detail.
One account can read another account’s private record.
Example severity: High
- Tested area
- Private record access across two authorized test accounts.
- Demonstration
- In this hypothetical case, a request from one test account returns a record owned by the other. The server accepts the record reference without checking ownership.
- Potential impact
- A user could read another customer’s private information.
- Suggested fix
- Check ownership or permitted access on the server for every request. Restricting what the interface displays would not be enough.
This is not a result from a Blackwall test. The finding and its severity are illustrative.