Get hacked by us first.
winfunc's autonomous agents audit your most important repository the way an attacker would, then hand you the proof and the patch. The initial assessment is free for eligible YC companies.
Audit brief
- Scope
- One mission-critical repository, agreed with you before work starts
- Method
- Autonomous agents trace untrusted input from source to sink
- Proof
- Reproduction in an isolated environment, where it is in scope
- Delivery
- Findings with traces, a report, and patches ready for review
- Cost
- Free for eligible YC companies
A scoped audit, not a black box.
The engagement starts with authorization and context, and ends with material your engineers can inspect.
- source
Agree on the scope.
Pick the repository and the security questions that matter most. Access, boundaries, and deliverables are confirmed before any code is read.
- trace
The agents investigate.
winfunc follows untrusted input through your code and reproduces exploitable paths in an isolated environment where that is in scope.
- patch
Review the evidence.
Each finding arrives with its trace, its impact, and a proposed patch. Your team reviews it through the normal process and decides what ships.
See the findings behind the claim.
The same agents have disclosed vulnerabilities in software teams already run. Each write-up has its own trace, reproduction conditions, and remediation.
- Public disclosures
- 48
- CVE IDs assigned
- 22
- Critical or high
- 33
| Project | Finding | Severity |
|---|---|---|
| Gumroad | 0-click Account Takeover and Admin Operations via helper endpoint authorization bypass | Critical |
| Fider | Domain-wide signup session enables cross-tenant administrator takeover | Critical |
| Ray | Unauthenticated Serve replica gRPC requests allow arbitrary code execution | Critical |
| Supabase | SQL Injection via queueName in getDatabaseQueuesMetrics | Critical |
| Anthropic | Authentication bypass on FastMCP custom routes | Critical |
| Formbricks | Feedback Records gateway accepts organization permissions across tenants | High |
| Cube | Presto and Trino filter interpolation bypasses row-level security | High |
| Sylius | Captured payment can be reused after cart total inflation | High |
Questions about the audit.
Scope, access, timing, and outputs are agreed before a repository is connected.
01How much does it cost?
The initial assessment is free for eligible YC companies. We will confirm scope, access, and expected deliverables before work begins. Ongoing reviews and broader product use are priced around the codebase and workflow.
02How long does the initial scan take?
Timing depends on repository size, language, setup, and the agreed depth of review. We will set an expectation after scoping the codebase rather than promise a generic turnaround.
03How is this different from a bug bounty?
A bug bounty invites independent researchers to test an authorized public scope. A Winfunc assessment starts with codebase access and a defined investigation scope. Many teams can use both: one for external researcher coverage and one for repeatable, code-informed review.
04Are the reports compliance-ready?
Reports can organize scope, method, findings, remediation status, and limitations as inputs to an audit or customer review. They do not by themselves establish compliance or guarantee that an assessor will accept the evidence.
05What type of issues does the agent catch?
A review can investigate common vulnerability classes and application-specific risks such as authorization gaps, tenant-boundary failures, state or race-condition issues, and sensitive-data exposure. Results depend on the application and scope.
06What languages does winfunc support?
winfunc is not tied to a single rule set. It combines parsers, language servers, and model-assisted analysis, and its public findings already span C, C++, Go, Rust, Python, TypeScript, PHP, Ruby, and Lua codebases. Share a representative repository and we will confirm depth for your stack before an audit.
07How does winfunc keep false positives out of the report?
Every candidate is traced from source to sink and checked against the controls on that path. Where testing is in scope, winfunc reproduces the exploit in an isolated environment and attaches the evidence. Anything it could not establish is labeled as inference, so your team reviews a short list of supported findings instead of a queue of alerts.
08Do you have SOC 2 certification?
winfunc is SOC 2 Type II audited. Current security and compliance documentation is available in the Trust Center.
Find it before
someone else does.
Book a call to scope your first audit. You get findings with traces, reproduction evidence where it is in scope, and patches ready for review.