Every pull request pentested before it ships

Neo reads the diff with the whole repository as context, runs the exploit in a preview build, and posts the proof as a review comment. Push the fix and the same exploit runs again.

Get StartedBook a demo

Every diff is read against your threat model. Trust boundaries, data flows and abuse cases from the repository, so Neo knows which of six changed files is worth attacking.

acme/apithreat-modelv14
Internetuntrusted
Public edgecloudflare
Private VPCacme-prod
Dataencrypted at rest
Customer
Partner API client
checkout.acme.com
api.acme.com
auth-service
orders-service
invoice-service
sessions (redis)
orders (postgres)
invoices (s3)
billing-worker
ledger (postgres)
T-03Cross-tenant invoice read
On this diff
Files changed6
  • api/invoices/export.tsinvoice-serviceT-03
  • api/invoices/schema.tsinvoice-service
  • api/lib/session.tsauth-service
  • web/routes/invoices.tsxapi.acme.com
  • test/invoices.test.ts—
  • docs/api.md—

Findings land as review comments. On the lines that introduced them, with the request that proved the exploit.

Add invoice export endpoint #4821

Open

acme/apipriya-n wants to merge 3 commits into main from feat/invoice-export

Conversation4Commits3Checks4Files changed6
42 const orgId = req.query.org_id as string;
43 const rows = await db.invoices.findMany({ where: { orgId } });
44 res.json({ org_id: orgId, count: rows.length, invoices: rows });
neobotrequested changes 4 minutes ago
api/invoices/export.ts:42
HighCross-tenant data exposureVerified in preview build
pr-4821.preview.acme.devOpen
1GET /api/invoices/export?org_id=org_8821 HTTP/2
2cookie: session=eyJhbGci… // logged in as org_1042
3HTTP/2 200 OK
4{ "org_id": "org_8821", "count": 1284, "invoices": [ { "id": "inv_77f0…", "total": 4180.00, … } ] }

org_id is never checked against the session, so any signed-in user can export another tenant’s invoices.

Suggested change
42 const orgId = req.query.org_id as string;
42 const orgId = req.session.org.id;
43 if (req.query.org_id && req.query.org_id !== orgId) {
44 return res.status(403).json({ error: 'forbidden', reason: 'org mismatch' });
45 }
Commit suggestionAdd to batch
ReplyResolve conversation

Proven in a preview build. Neo takes your preview URL, signs in and runs the exploit before anything is posted.

TasksReview PR #4821
Running 6m 12s
  1. Mapped the change
  2. Connected to the preview build

    pr-4821.preview.acme.dev, built from a41f9e2.

  3. Signed in as tenant A

    Logged in through the browser as org_1042 with the test account from the secret store.

  4. Exported tenant B’s invoices
    pr-4821.preview.acme.devOpen
    1GET /api/invoices/export?org_id=org_8821 HTTP/2
    2HTTP/2 200 OK
    3{ "org_id": "org_8821", "count": 1284, … }
  5. Posting review comment…

Push the fix, and the same exploit runs again. The check turns green only when the attack no longer works.

Add invoice export endpoint #4821

Open

acme/apipriya-n wants to merge 4 commits into main from feat/invoice-export

Conversation7Commits4Checks4Files changed6
PNScope invoice export to the session’s organization3f9c2ad
neobotresolved the conversation 2 minutes ago
Re-tested on 3f9c2ad
pr-4821.preview.acme.devOpen
1GET /api/invoices/export?org_id=org_8821 HTTP/2
2HTTP/2 200 OK
2HTTP/2 403 Forbidden
3{ "error": "forbidden", "reason": "org mismatch" }
neo / security-review—0 exploitable findings, 1 fix verifiedDetails
preview / deploy—pr-4821.preview.acme.devDetails
ci / test—412 passedDetails
ci / build—Succeeded in 3m 04sDetails
Merge pull requestAll checks have passed

The bugs that get merged. Authorization and logic flaws that take two accounts or a live checkout to prove.

GET /api/invoices/export?org_id=org_8821
1,284 rowsas org_1042

Cross-tenant data exposure

One tenant reads another tenant’s records by swapping an identifier.

GET /api/users/1042/api-keys
3 keysas user 2210

Broken object ownership

Change an ID in the path and read another user’s resource.

POST /api/refunds/4471/approve
approvedreview step skipped

Workflow step skipping

Call the final endpoint without the steps before it and get an approved outcome.

PATCH /api/orgs/1042/members/88
role: adminas member

Hidden admin actions

The UI hides the control. The backend still accepts the request.

POST /api/cart/apply-coupon ×3
total 0.00same instant

Race and double-spend

Parallel requests slip past single-use and balance checks.

POST /api/checkout { unit_price: 1 }
paid 1.00list price 128

Checkout price tampering

Modify price or quantity in the request and still complete checkout.

Trusted by security teams