fast
The day's hunt
A focused pass over what changed recently. Hours, not days.
‹ all agents
private preview
The Hunter
hunter
A finding is only filed once a proof-of-concept has run in an isolated sandbox and fired, and a second model family has independently confirmed it. Severity and a CVSS vector only — never a dollar or business-impact estimate.
- Triggerson demand, three depth levels
- Levelsthe day's hunt · the overnight hunt · the long hunt
- Outputa tracked issue per confirmed finding, deduped across runs
- AvailabilityPrivate preview — invite only, not yet self-serve
Every finding carries a proof that ran. Anything the verifier could not confirm is dropped rather than filed as a maybe — so the issue count is lower than a scanner's, and each one is real.
Levels & categories
deeper
The overnight hunt
A wider sweep with more verification budget, run while nobody is waiting.
exhaustive
The long hunt
Full-repo, multi-pass, adversarially verified. The slowest and the most thorough.
Sample output
The issue a confirmed finding opens. Real output from a production run — not a mock-up.
## 🛡️ Proven vulnerability
The **wrokin security hunter** found this issue, wrote a proof-of-concept, and
**detonated it in an isolated sandbox** — it fired. Independently verified by a
second model family.
| | |
|---|---|
| Severity | **high** |
| Category | CWE-78: OS Command Injection |
| CVSS | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| Location | `services/greeter.js:10` |
| Finder → verifier | deepseek-v4-pro → gpt-5.1 |
### Data flow
- source: req.query.name
- sink: execSync(`echo ${name}`)
### Proof of exploitation
```
uid=65534(nobody) gid=65534(nogroup)
```
_Advisory — the hunter never blocks your PR._
Integration status
Private preview — not customer-enableable. There is no config stanza to commit and no key to add; access is invite-only. Don’t plan an integration around it; the machine surfaces (capabilities.json) will say when that changes.