xalgorix/xalgorix
New · under observationOverview
Autonomous AI pentesting platform that proves vulnerabilities with working exploits, not just detection.
Not yet sourced · 8 fields
Customers / users · Business model · Industry · Legal name · Location · Founded · Employee count · Latest valuation found
Developments · past 30 days
News & announcements · 23
A signed token is not proof: verifying OpenID Connect relying-party flaws
2026-11-07 · xalgorix.com
A passed check is not proof: the SSRF filter that resolves DNS twice
2026-11-06 · xalgorix.com
Weekly AppSec Threat Digest: WordPress Upgrade RCE in KEV, Rails File Write, Ivanti Zero-Days
2026-11-06 · xalgorix.com
An error is not proof: verifying an exploitable SQL injection
2026-11-05 · xalgorix.com
An alert(1) is not proof: verifying an exploitable cross-site scripting vulnerability
2026-11-05 · xalgorix.com
A limit that broke once is not proof: verifying web race conditions
2026-11-04 · xalgorix.com
An accepted upload is not proof: verifying an exploitable file upload
2026-11-03 · xalgorix.com
A 9.8 is not a priority: ranking vulnerabilities by exploitability, not CVSS
2026-11-02 · xalgorix.com
A missing token is not proof: verifying a CSRF vulnerability
2026-11-01 · xalgorix.com
A parsed entity is not proof: verifying XML external entity injection
2026-10-31 · xalgorix.com
Weekly AppSec Threat Digest: PHP2Shell Hits KEV, Cisco ASA Zero-Day, GitLab & Drupal Exploited
2026-10-30 · xalgorix.com
An echoed instruction is not proof: verifying prompt injection in LLM applications
2026-10-29 · xalgorix.com
A reachable admin function is not proof: verifying broken function level authorization
2026-10-28 · xalgorix.com
A reflected Origin is not proof: verifying an exploitable CORS misconfiguration
2026-10-27 · xalgorix.com
A 302 is not proof: verifying an OAuth redirect_uri account takeover
2026-10-26 · xalgorix.com
A timing blip is not proof: safely confirming HTTP request smuggling
2026-10-25 · xalgorix.com
{{7*7}} is not RCE: how to actually prove server-side template injection
2026-10-24 · xalgorix.com
A 200 is not proof: verifying IDOR and broken object level authorization
2026-10-23 · xalgorix.com
Weekly AppSec Threat Digest: PHP2Shell RCE, VeloCloud Zero-Day, Plex2Shell & GitLab
2026-10-23 · xalgorix.com
GraphQL security beyond introspection: batching, aliasing, and limits that hold
2026-10-22 · xalgorix.com
From “possible SSRF” to proof: how to verify server-side request forgery
2026-10-21 · xalgorix.com
Weekly AppSec Threat Digest: Ivanti, Cisco & BeyondTrust Zero-Days, Next.js RCE
2026-10-17 · xalgorix.com
Weekly AppSec Threat Digest — Oct 2–9, 2026
2026-10-09 · xalgorix.com
Private notes & workspace
Private to this browser. Export your workspace to move notes between devices.