Continuous, automated penetration testing
Add one step to your pipeline. Argus attacks your staging build the way an outsider would, blocks the release on real findings, and keeps a signed public certificate current while you pass.
# .github/workflows/deploy.yml, after your staging deploy
- name: Argus security test
uses: argus/action@v1
with:
token: ${{ secrets.ARGUS_TOKEN }}
target: https://staging.acme.dev
fail-on: high
certificate: trueHow it works
01
Prove you own the target with a DNS record, then point Argus at the environment your pipeline just deployed.
02
Crawling, authenticated API testing, injection, access control and config checks run against the live build, not just the source.
03
Findings above your threshold fail the build with a fix-ready report. Passing releases renew your public certificate.
| Aspect | Annual manual pentest | Argus in CI |
|---|---|---|
| How often | Once or twice a year | Every release |
| Time to a result | Weeks | Minutes, inside the pipeline |
| What customers see | A PDF that ages from day one | A live certificate tied to the latest release |
| Business logic and chained attacks | Strong: human creativity | Limited: pair with a periodic manual test |
What we test
Every finding is tagged to OWASP Top 10, OWASP API Top 10 and CWE, so the report drops straight into SOC 2 and ISO 27001 evidence.
SQL, NoSQL, command, template and header injection.
Broken object-level auth, IDOR, privilege escalation, session handling.
Reflected, stored and DOM XSS; CSRF; open redirects.
OpenAPI and GraphQL aware: mass assignment, rate limits, data exposure.
TLS configuration, HSTS, CSP, cookie flags, CORS.
Every fixed finding is retested on every run so it stays fixed.
Safe to run on every build
Argus refuses to test a host until a DNS or file check proves you own it. Paths you exclude are never touched.
No data deletion, no denial of service. Write tests run only against test accounts you provide.
Set a request ceiling per run. Every request carries a signed header so your WAF and logs can tell it apart.
Captured evidence is encrypted, redacted for secrets and kept for [N] days, or run the scanner on your own runners.
Shareable certificate
Each passing release updates a public page with the date, scope and result of your latest test. It is signed, tied to a commit, and expires on its own if you stop testing, so buyers know it is current.
Acme Cloud
app.acme.dev · api.acme.dev
Every plan starts with a [N]-day free trial. No card needed.
[PRICE] /month
[PRICE] /month
Custom
No. Argus catches the large class of issues a scanner can find, on every release. Keep a periodic manual test for business logic and chained attacks; Argus makes it cheaper because the easy findings are already gone.
A full scan takes [N] minutes. Pull requests can run a quick profile that only tests what changed, and you can run it in parallel with your other tests.
Only the summary: scope, standards, dates, and the count of open High and Critical findings. Details and evidence stay in your account until you share them.
The CI step exits non-zero so the release is blocked. Your certificate keeps showing the last passing release until it expires, so a failed build never shows publicly as a failure.
Setup takes one YAML step and a verified staging URL.
Add Argus to CI