ohmakohq[bot]Proof, not guesses
A proof-of-concept exploit for each finding, with the evidence and screenshots.
Security Testing
Coming (phase 6)Security found late isn't actionable
AI penetration testing in CI: each change attacked in a sealed copy of your app, never production, with a proof of concept and a fix for every finding.
Test what you shipIllustrative. The app, findings and commands in it are examples.
From a pull request to a fix.
A pull request starts a test
Your rules say when a test runs and how deep it goes. A pull request might get a low-mode test while main gets a high one.
Your app starts in a sealed sandbox
It starts your application from its Docker or Docker Compose files, with test data, inside an OhMako sandbox. The sandbox holds no production credentials, and its outbound network is controlled.
It explores the ways in
It maps the application and tries the paths an attacker would, against that copy and nothing else.
It proves what it found
Every finding comes with a proof-of-concept exploit, the evidence and screenshots, so you see it work before you fix it.
Findings go to your agent to fix
Findings arrive as comments on the pull request, each with its fix, ready to hand to your coding agent. They export as SARIF for your other security tools too.
Isolation
It never runs against production.
It tests only your application started inside an OhMako sandbox, from Docker or Docker Compose, with test data. It never touches your servers, it holds no production credentials, and its outbound network is controlled.
Rules
As deep as each branch needs.
A branch rule is a regular expression with a mode: low, medium, high or extra high. Tests start on a pull request, a push, before merge, before deploy, on a schedule or by hand, and rules combine.
main
high
pull requests
low
deploys
extra high
Start one by hand from the web app, have your agent start one over MCP, or run ohmako security at a terminal.
Reports
Findings you can act on today.
The fix
What to change for each finding, in words your coding agent can act on.
Where you work
Comments on the pull request, SARIF export, and the history of every test.
Price
Pay for what each test uses.
The AI usage behind a test at cost plus 20%, plus the time of the sandbox your app runs in, whose per-minute price is published with the product.
Join the invite list
Tell us which products you want first. Invites go out in waves, product by product.
Test what you ship