BugBunny is an AI security engineer. It pentests your apps, code and cloud 24/7/365, confirms each finding is exploitable, and opens a pull request with the fix.
New accounts get $100 in welcome credit. After that, scans are pay as you go.
Example: a WordPress core CVE published on a Friday night.
Night, 20:00 to 07:00
Security research recognized across
Web apps, mobile apps, system apps, smart contracts and blockchain nodes, in black box and white box. Give BugBunny a URL, a build or a deployed address and it attacks from the outside. Connect the source and it reads the code too, then shows you the exact line.
From the outside, with only a URL and a test login.
GET /api/invoices/10442Authorization: Bearer <tester B>HTTP/1.1 200 OK{ "id": 10442, "owner": "tester A", "total": "€18,400.00" }Reproduced 3 of 3 times with two test accounts
From the inside, with the repository.
src/routes/invoices.ts
app.get('/invoices/:id', auth, async (req, res) => { const invoice = await db.invoice.findUnique({ where: { id: Number(req.params.id) },Looks the invoice up by ID only. Nothing checks that it belongs to req.user. }); if (!invoice) return res.status(404).end(); res.json(invoice);});
Any signed-in user can read every customer’s invoices.
Exploit confirmed from outside.
Root cause at invoices.ts:14.
Illustrative examples. Black box needs only what an attacker has. White box adds read-only access to your source.
New CVEs drop on Friday nights and over holiday weekends. BugBunny keeps testing through them, so new exposure is found the day it appears instead of at the next quarterly pentest.
BugBunny learns your environment, tests it the way an attacker would, and prepares the fix. You approve anything that touches production.
Point BugBunny at your domains, GitHub repositories and AWS, GCP or Azure accounts. You decide the scope and what it can touch.
It inventories your hosts, endpoints and dependencies, and updates that inventory every time you ship.
It tests your assets the way an attacker would and reports only the findings it can reproduce, each with the evidence.
You get the smallest safe patch as a pull request. Anything that changes production waits for a named human to approve it.
Every finding is validated with evidence and arrives with its fix ready for review.
110
Real vulnerabilities in 49 products, including UniFi OS, Apache Airflow, IBM Langflow OSS, React Router, lodash, etcd, reported to their vendors and maintainers through coordinated disclosure.
Start with $100 in welcome credit. After that, you only pay for the scans BugBunny runs.
Monthly platform fee. Scans are billed separately from your usage wallet.
For larger estates, regulated teams and procurement processes. Priced with you.
Talk to sales about
Estimated cost of 8,958 completed June scans. Your cost depends on target size, authentication, repository context and validation depth.
Completed scans only. Stopped, failed and sub-$0.10 early-exit runs are excluded. The right tail reflects a smaller number of substantially deeper audits. See the full June distribution
Estimate based on June 2026 completed-scan costs. Welcome credit is one-time for new accounts. Coupon terms are shown at checkout. Taxes not included.
New accounts get a one-time $100 welcome credit in their usage wallet, so the first scans are covered. It applies when you sign up without a coupon code. If you use a coupon, the coupon’s terms apply instead; the two are not combined.
Scans are pay as you go and draw from your usage wallet as they run. Cost follows the work: target size, authentication, repository context, depth and validation. In June 2026 the median completed scan cost $17.39.
BugBunny pauses the running scan safely and resumes after a top-up, so your team does not have to start again.
No. BugBunny prepares fixes as pull requests or staged patches. Anything that changes production waits for approval from a named human manager on your team.
Tell us what BugBunny should cover, what it can access, and who should approve consequential actions. We will scope the first scans, pricing, and the right operating boundaries with your team.
New accounts get $100 in welcome credit for their first scans.