BugBunny is an AI security engineer. It pentests your apps, code and cloud 24/7/365, confirms each finding is exploitable, and opens a pull request with the fix.
Your first $100 platform fee comes back as $100 in scan credit. After that, scans are pay as you go.
Example: a WordPress core CVE published on a Friday night.
Night, 20:00 to 07:00
Security research recognized across
Web apps, mobile apps, system apps, smart contracts and blockchain nodes, in black box and white box. Give BugBunny a URL, a build or a deployed address and it attacks from the outside. Connect the source and it reads the code too, then shows you the exact line.
From the outside, with only a URL and a test login.
GET /api/invoices/10442Authorization: Bearer <tester B>HTTP/1.1 200 OK{ "id": 10442, "owner": "tester A", "total": "€18,400.00" }Reproduced 3 of 3 times with two test accounts
From the inside, with the repository.
src/routes/invoices.ts
app.get('/invoices/:id', auth, async (req, res) => { const invoice = await db.invoice.findUnique({ where: { id: Number(req.params.id) },Looks the invoice up by ID only. Nothing checks that it belongs to req.user. }); if (!invoice) return res.status(404).end(); res.json(invoice);});
Any signed-in user can read every customer’s invoices.
Exploit confirmed from outside.
Root cause at invoices.ts:14.
Illustrative examples. Black box needs only what an attacker has. White box adds read-only access to your source.
New CVEs drop on Friday nights and over holiday weekends. BugBunny keeps testing through them, so new exposure is found the day it appears instead of at the next quarterly pentest.
BugBunny learns your environment, tests it the way an attacker would, and prepares the fix. You approve anything that touches production.
Point BugBunny at your domains, GitHub repositories and AWS, GCP or Azure accounts. You decide the scope and what it can touch.
It inventories your hosts, endpoints and dependencies, and updates that inventory every time you ship.
It tests your assets the way an attacker would and reports only the findings it can reproduce, each with the evidence.
You get the smallest safe patch as a pull request. Anything that changes production waits for a named human to approve it.
Every finding is validated with evidence and arrives with its fix ready for review.
110
Real vulnerabilities in 49 products, including UniFi OS, Apache Airflow, IBM Langflow OSS, React Router, lodash, etcd, reported to their vendors and maintainers through coordinated disclosure.
Your first $100 platform fee comes back as $100 in scan credit. Beyond the monthly fee, you only pay for the scans BugBunny runs.
Monthly platform fee. Scans are billed separately from your usage wallet.
For larger estates, regulated teams and procurement processes. Priced with you.
Talk to sales about
Estimated cost of 8,958 completed June scans. Your cost depends on target size, authentication, repository context and validation depth.
Completed scans only. Stopped, failed and sub-$0.10 early-exit runs are excluded. The right tail reflects a smaller number of substantially deeper audits. See the full June distribution
Estimate based on June 2026 completed-scan costs. The welcome credit comes once, with your first platform fee. Coupon terms are shown at checkout. Taxes not included.
When you pay your first $100 platform fee, we add a one-time $100 welcome credit to your usage wallet. Your first month’s fee comes back as scan credit, and the fee is billed normally from the second month. The credit is granted once per account and expires after 365 days. It isn’t combined with coupon codes: if you use one, the coupon’s terms apply instead.
Scans are pay as you go and draw from your usage wallet as they run. Cost follows the work: target size, authentication, repository context, depth and validation. In June 2026 the median completed scan cost $17.39.
BugBunny pauses the running scan safely and resumes after a top-up, so your team does not have to start again.
No. BugBunny prepares fixes as pull requests or staged patches. Anything that changes production waits for approval from a named human manager on your team.
For companies with web apps, mobile apps, system apps, smart contracts or blockchain nodes. Selected companies get a month of BugBunny, with $1,000 in scan credit and the $100 platform fee covered.
List every domain and subdomain you want tested.
One scan per domain and subdomain, started on your behalf.
Applications come from your BugBunny account, so we know the company email is yours. Sign in, or create an account with your company email, and you’ll come straight back here.
Your first $100 platform fee comes back as $100 in credit for your first scans.