What does "exploit validation" actually mean?

For in-scope pentest findings, exploit validation means a finding is reported with reproducible exploit evidence. Nullify then scores impact against your business context, prepares a fix, and manages the pull request through review until your team merges it.

How is this different from a CVSS score or a scanner's severity rating?

A CVSS score estimates theoretical impact. For in-scope REST and GraphQL pentest findings, Nullify actively tests the path and provides reproducible evidence of what was exploited.

What evidence do we actually get?

Request/response pairs, screenshots and video for anything the pentest agent exploits, plus a second, independent review of the exploit against its own evidence before it's reported. It's built to be handed straight to a developer or an auditor, not re-verified by hand.

Does every finding get this same live-exploit treatment?

Live, evidence-backed exploitation is how Nullify's pentest agent validates REST and GraphQL API findings; SPA and SSR applications are covered through Bug Hunts, which promote confirmed exposure into a full pentest. Across all finding types, triage still checks reachability and exploitability before anything reaches a human — pentests are where that proof becomes a first-hand exploit.

Does exploit validation apply to fixes, or just findings?

Both, with evidence appropriate to each stage. Pentest findings carry reproducible exploit evidence; proposed fixes are independently reviewed and validated against the build and relevant tests before a merge-ready pull request reaches your team.

Exploit Validation

Every finding
proven before you see it.

Active, multi-stage exploitation, re-reviewed against its own evidence. Fixes have to prove themselves too.

Book a Live Demo Read the Docs

Fewer findings. All of them real.

What reaches your teamShare of raw scanner outputProof

Nullify

exploit

Reachability filter

call graph

Raw scanner

signature

100+

findings validated
for exploitability

2×

every exploit reviewed twice
before it reaches you

Move from noisy finding lists
to proven, merge-ready fixes

Exploit

Proves before it reports

Chains requests and application logic the way an attacker would, informed by your code, dependencies and cloud.

Assessment steps · live

Testing whether the role claim is ever verified…

POST /api/session {"role":"admin","sig":null}

200 OK admin session issued

Pivoting to payout endpoints with the forged session…

Second review

✓Verdict holds. Reproduced from evidence alone.

$ ./reproduce-exploit.sh

replaying 3 requests from evidence…
step 2/3 · 200 OK · role=admin
reproduced ✓ · attached to NFY-2214

Re-review

Checked a second time

Every exploit is replayed from its own evidence before it counts. A re-review pass, not a single agent's word.

Proof, Stacked

Each step leaves something behind the next one can check. By the time a fix reaches your team, three layers of proof sit underneath it.

01

Suspect

02

Exploit

03

Re-review

0400:36

Fix Proven

The exploit is replayed against the patch before the pull request opens. Plausible isn’t enough.

OpenVerify signed role claims · #1284

- trust(claims.role)

+ verify(claims, key).role

exploit replay → 401 Unauthorized ✓

Three layers of proof attachedMerge-ready

Proof Lands Where Your Team Already Works

Launch from the console, the CLI or a GitHub Action. Evidence shows up in the pull request and the escalation thread, not a separate dashboard.

Terminal · nullify CLI

$ nullify pentest run --target payments-api
→ mapping 214 routes · 38 in scope
→ exploiting POST /api/session … 200 OK · role=admin

Slack · #security-escalations

Nullify9:14 AM

Exploit confirmed and re-reviewed on payments-api. Fix #1284 replayed clean.

Pull request · evidence attached

Openacme/payments-api #1284

Verify signed role claims

nullify opened this PR

The session endpoint issued admin sessions from an unsigned role claim. Reproduction below; the patch makes it return 401.

req/resscreenshotvideo

›_ Exploit reproductionrepro.sh

1  curl -s -X POST $HOST/api/session \
2    -d '{"role":"admin","sig":null}' -c jar
3  # → 200 OK · role=admin
4  curl -s -b jar $HOST/admin/payouts
5  # → 200 OK · 14 payout records
6  # after #1284 → 401 Unauthorized ✓

A scanner tells you something might be wrong. Nullify shows you it is — and that the fix works.

Exploit the path

Active, multi-stage exploitation informed by your code, dependencies and cloud — not a signature match.

Collect the evidence

Re-review it independently

Prove the fix

Pentest · payments-apiRunning

FindingExploitedRe-reviewFix

Auth bypass · /api/sessionyes✓ holds✓ #1284

IDOR · /api/orders/:idyes✓ holdsdrafting

Mass assignment · /usersno——

SSRF · /webhooks/testtesting…——

Works with

Proof Across the Whole Program

$ nullify pentest run
→ 38 routes in scope · 4 exploited
→ evidence attached

AI Pentest Agent

Continuous, multi-stage testing of REST and GraphQL APIs.

Triage queue

✓ High · 4,545 kept · ranked

Low · noise · 36,364 suppressed

Triage & Remediation

Prioritize proven findings, then ship fixes driven to merge.

Scoped honestly

Where Live Exploitation Runs

Live exploitation targets REST and GraphQL APIs. SPA and SSR applications are covered through Bug Hunts, which promote confirmed exposure to a full pentest.

Get a Demo Read the Docs