Free pentest / 15-team cohort

Put Apex against the attack surface you worry about most.

Apex is Cantina's agentic OffSec engineer. It investigates your attack surface, validates exploitable paths, and helps close the security loop by verifying that the fixes hold.

Free pentest for accepted teams

Private findings delivered directly

Fix and retest included in the outcome

SOC 2 Type 2 CompliantScope and written authorization are confirmed before testing begins.

Free pentest application

Apex / Cantina

15 teams

Next cohort

Apply for a free pentest.

Tell us what you want tested. We'll follow up with availability, scope, and next steps.

Form loading

If nothing loads here, please try refreshing the page or changing your browser restrictions.

Applications are reviewed in order and remain private.

Public research

The findings no one else caught.

The same agentic OffSec engineer available in this cohort has uncovered vulnerabilities in widely scrutinized software.

Apple WebKit

Credited by Apple

Three vulnerabilities, including one hidden for 13 years.

Apex uncovered two Content Security Policy enforcement failures and a separate path to sensitive user data.

Web content

Policy boundary

Sensitive data

Read the public finding

Claude Code

Workspace trust bypass

A malicious repository could change execution behavior before trust.

Apex found that repository-controlled settings could place Claude Code into a permissive execution mode before the user confirmed trust.

Repository

Trust prompt

Execution mode

Read the public finding

OpenClaw

High · CVE-2026-26325

Command validation could approve one action and execute another.

Apex found a command mismatch in affected companion-node configurations that could bypass the execution approval a user expected.

Approved command

Argument mismatch

Execution

Read the public finding

From first signal to verified fix

The pentest closes the loop.

The pentest carries context from investigation through remediation, then verifies each fix against the original attack path.

Investigate

Apex maps the attack surface, identities, application behavior, and reachable paths.

Validate

Apex follows promising paths until it can prove impact or close the lead.

Fix

Your team receives a targeted fix or fix-ready remediation, with implementation handled inside the scope you approve.

Verify

Apex retests the same path and records whether the vulnerability is closed.

One of 15 teams.Bring the attack surface you want tested.

Apply for a free pentest