MapperPlus

Don't let a security issue block your next feature release.

We hack you. Then fix your code. Autonomously!

MapperPlus attacks every host you put online the way an intruder would, then writes the fix. Your engineers just merge.

ISO 27001 certifiedNothing to installYour team merges every fix

Read a sample finding

Production · Team

Discovery running

Open now

3

Critical, proved on the live system

Ready for review

1

The code is fixed. Your team merges.

These are the issues that can hold the next release.

3 critical11 high42 medium

Apex domains

12

All verified

Live hosts

2,143

+18 in 24h

Subdomains

17,494

+42 in 24h

IP prefixes

38

Across 4 networks

Exposed ports

6,558

3 new

Remediation pipeline

MP-1842 · Discovered

  1. Discovered
  2. Triage
  3. Validated
  4. Fix proposed
  5. Deployed

What can block the release

  • CriticalMP-1842

    Payment bypass: the order ships even when nothing is charged

    POST pay.acme.com/v1/checkout/capture

    Discovered

  • CriticalMP-1836

    Privilege escalation: a normal account can grant itself admin

    PATCH api.acme.com/v1/users/role

    Validated

  • CriticalMP-1821

    Unlimited token mint: credits are created with no cap

    POST api.acme.com/v1/billing/credits

    Fix proposed

Autonomous by default

We protect your servers.

New hosts are mapped and tested as they appear.Your team only reviews the fix.

  • api.acme.com is live

    Tested the day it goes live

    A host that goes live tonight is tested tonight. Nothing waits for the next engagement.

  • Reproduced live

    Every finding reproduces

    A finding exists only once it reproduces on the live system, with the request that proved it.

  • Approved by you

    Nothing ships without you

    The fix arrives as a merge request. Your engineers read it like any other change.

How it works

Three stages run on their own. Your team ships the fourth.

All services →
  1. 01

    Discover

    Autonomous

    Assets, servers, DNS, and open ports, found in real time.

    • Cloudflare
    • ShodanShodan
    • SecurityTrailsSecurityTrails
    • VirusTotal
    • Xleak.io
    • etc.
  2. 02

    Pentest

    Autonomous

    Every reachable host tested. Only what reproduces is reported.

    • MapperPlus
  3. 03

    Remediate

    Autonomous

    We fix the code for you, at the exact line.

    • GitHub
    • GitLab
    • Bitbucket
    • etc.
  4. 04

    Release

    Your team

    Your team reviews the fix and ships it.

    • Jira
    • Linear
    • PagerDuty
    • etc.
Autonomous & Continuous Penetration Testing

We find vulnerabilities.

Requests are chained on the live system.Only what reproduces is reported.

Autonomous penetration testing

A new host appeared at 09:14. The fix was ready to merge at 09:26.

One finding, end to end. MapperPlus chained three requests on the live system, replayed them until the result was the same every time, traced it to one line, and opened the merge request. No scan scheduled, no ticket filed, nobody paged.

From the acme.com demo workspace. Acme is not a real company.

  1. 09:14Host on the map
  2. 09:15Pentest starts
  3. 09:21Reproduced 3 of 3
  4. 09:24Traced to line 49
  5. 09:26Merge request opened

Attack chain

pay.acme.com · MP-1842

Reproduced 3 of 3
  1. 1

    POST /v1/orders

    { "items": ["sku_2041"], "total": 49.00 }

    201 · { "id": "ord_7Q2", "status": "pending" }

  2. 2

    POST /v1/orders/ord_7Q2/coupon

    { "code": "WELCOME10" }

    200 · { "status": "pending", "charged": false }

  3. 3

    POST /v1/checkout/capture

    { "order": "ord_7Q2" }

    200 · { "status": "shipped" }

Payment bypass: the order ships even when nothing is charged.

gateway · no charge recorded for ord_7Q2

traced · checkout/capture.ts:49

The fix

checkout/capture.ts · line 49

Ready for review

The coupon branch returned before the charge was captured. The change captures first and rejects the order when nothing was charged.

checkout/capture.ts

+3−1

48 async function capture(order) {
49−if (order.coupon) return fulfill(order)
49+const charged = await gateway.capture(order.total)
50+if (!charged || order.total <= 0) return reject(order)
51+return fulfill(order)
52 }

Fixed by MapperPlus · a coupon can no longer complete checkout without a captured charge.

!482 Capture payment before fulfilment

Opened by MapperPlus · review requested

+3−1
From a new host to a merge request
12 min
Replays that reproduced before it was reported
3 of 3
Lines changed, opened for your engineers to review
+3 −1
Read this finding in full
Automated code remediation

We fix your code.

The line that causes the issue is changed, and a merge request is opened.Your engineers review it.

Remediation

A merge request, not a PDF.

The fix lands in GitHub, GitLab, or Bitbucket the way any change from a colleague would: a branch, a description of what it stops, a passing pipeline, and the finding it closes. Your engineers approve and merge.

  1. 01The finding it fixes, linked from the description
  2. 02The file, the line, and the pipeline result
  3. 03Approve and merge, like any other change
acme / payments/Merge requests!482
Open

Capture payment before fulfilment

MapperPlusrequests to mergemapperplus/fix-mp-1842intomain

The coupon branch returned before the charge was captured, so an order with a coupon shipped without payment. This change captures first and rejects the order when nothing was charged.

Pipeline
Passed · 3 of 3 jobs
Changes
checkout/capture.ts · +3 −1
Fixes
MP-1842 · Payment bypass on POST /v1/checkout/capture
Severity
Critical · orders ship with no captured payment

2 reviewers requested · nothing merges without them

ApproveMerge
Alerts to Jira, Linear & PagerDuty

We notify your engineers.

A ticket opens the moment a finding is proved.Your engineers see it where they already work.

Alerting

The finding lands in the queue that owns it.

  • Jira

    A ticket, with severity and the asset.

  • Linear

    An issue in the engineering queue.

  • PagerDuty

    A page when the severity cannot wait.

Attack surface management

We map every host.

New subdomains, open ports, and leaked keys show up on their own.Each one is tested the moment it appears.

Attack surface management

The map updates itself.

Cloudflare, Shodan, SecurityTrails, and VirusTotal stay connected. New hosts, DNS changes, and exposed ports appear in real time, with no scan to schedule.

  1. 01Zones, scans, and name history connected
  2. 02Hosts, subdomains, and ports kept current
  3. 03Repos, leak sources, and tickets on the same switches

  • Cloudflare

    Zones and DNS

    Off

  • VirusTotal

    Enrichment

    Off

  • Xleak.io

    Leaked credentials

    Off

  • GitHub

    Repos for code lookup

    Off

  • GitLab

    Code fixed for you

    Off

  • HackerOne

    Program intake

    Off

  • Jira

    Tickets from findings

    Off
Exposure discovery

Everything it finds, opened as a finding.

A new subdomain, an open port, or a leaked credential: each one lands in the same list, with its source and its status.

Open exposures

New names and reachable hosts, opened as findings.

  • New subdomain

    dev-payments.acme.com

    SecurityTrails · DNS

    New

  • Exposed admin server

    admin.acme.com:8443

    Shodan · open port

    In review

  • Staging API still public

    stage-api.acme.com

    Cloudflare · zone

    Validated

  • Employee passwords

    acme.com

    Xleak.io · stealer log

    New
Secret monitoring

Every public script, read the moment it changes.

A new file, or a new hardcoded key, opens a finding with the URL and the line.

checkout.8f3c.js

Watching

pay.acme.com/assets/checkout.8f3c.jsupdated

8const endpoint = "/v1/charges"
9const stripeKey = "sk_live_acme_demo"
10async function charge(order) {
11 return fetch(endpoint, {
12 headers: {
13 "X-Signature": "whsec_demo_only"
14 }
15 })
16}

PROBLEMS0

  • Waiting for the next change…
Bug bounty

We fix what researchers find.

A HackerOne or Bugcrowd report is reproduced like our own finding.The fix lands in your code the same way.

Bug bounty

Internal findings and researcher reports.

Your own security program

Attack surface, live proof, and the code fixed for you.

A bug bounty program

Researcher reports are reproduced and fixed in your code, like your own findings.

HackerOne · #2291Triage

Coupon applied twice on one order

POST /v1/orders/:id/coupon

submitted by a researcher

Replaying on pay.acme.com

Reproduced 3 of 3

Traced to coupon.ts:88

acme / payments · !483Pipeline passed

Apply a coupon once per order

coupon.ts:88 · +2 −1 · fixes #2291

opened by MapperPlus
Merged by your team

Why MapperPlus

We replace the yearly pentest and the scanner.

A pentest is deep but rare. A scanner is frequent but noisy.MapperPlus tests as deeply as an attacker, as often as your assets change.

  • How often

    MapperPlus: Continuously, as assets change

    Annual pentest
    Once or twice a year
    Scanner
    On a schedule

  • What is covered

    MapperPlus: Every asset it discovers

    Annual pentest
    The scope in the contract
    Scanner
    The assets you list

  • Proof

    MapperPlus: Only what reproduces live

    Annual pentest
    Written up by hand
    Scanner
    A signature match

  • The fix

    MapperPlus: The code, fixed for you

    Annual pentest
    Recommendations in a PDF
    Scanner
    Generic advice

See what MapperPlus finds on your domain.

Plans from $990 a month, every service included. See pricing

Read a sample finding →

Integrations

Every source is a switch.

Attack surface, leak sources, code hosts, bounty intake, and alerting. Each connection is turned on in settings, and the finding keeps its asset and its severity.

  • Cloudflare
  • ShodanShodan
  • SecurityTrailsSecurityTrails
  • VirusTotal
  • Xleak.io
  • GitHub
  • GitLab
  • Bitbucket
  • HackerOne
  • Bugcrowd
  • Jira
  • Linear
  • PagerDuty
  • etc.

FAQ

Questions security teams ask first.

More on certification, code access, and proof on the security page.

How is this different from a vulnerability scanner?

A scanner matches signatures and reports what might be wrong. MapperPlus chains requests against the live system like an attacker would, and reports only what it can reproduce, with the requests that proved it.

Does it replace our annual pentest?

It tests continuously, so new hosts and new code are covered as they appear instead of at the next engagement, and every host it discovers is in scope, not only the list in a contract. Each finding comes with its proof and its fix, ready for your audit trail.

Can it find business logic flaws?

Yes. Payment bypasses, privilege escalation, and uncapped credit creation are the kind of issues it chains together and proves on the live system.

What access does it need to our code?

Repository access in GitHub, GitLab, or Bitbucket, granted as a switch in settings. MapperPlus finds the file and the line, and opens a merge request with the fix. It never merges or releases. Your engineers review and ship every change.

Is MapperPlus certified?

Yes. MapperPlus is ISO/IEC 27001 certified. Data is encrypted in transit and at rest, and SSO with SAML is available. The certificate and our security overview are available on request.

Do we need to install anything?

No. There is no CLI and no agent. You add your domains, and every source is a switch in settings.

How is it priced?

Plans start at $990 a month, billed annually, and every plan includes everything from finding the asset to fixing the code: discovery, continuous pentesting, reports with proof, the merge request, and alerting. The price follows your attack surface. Starter covers one domain and 25 live hosts. Growth covers three domains and 100 hosts. Scale covers ten domains and 500 hosts. Above that, we size an Enterprise plan with you.

What would MapperPlus find on your domain?

Enter it below. MapperPlus maps it, tests it, and we walk you through what it finds.

ISO 27001 certifiedNothing to installYour team merges every fix