> ## Documentation Index
> Fetch the complete documentation index at: https://docs.launchsafe.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Introduction
> LaunchSafe is an AI-powered penetration testing platform — autonomous AI hackers that find, exploit, and fix vulnerabilities before attackers do.
LaunchSafe is an **autonomous penetration testing platform** built for modern engineering teams. It combines static analysis, dynamic testing, dependency scanning, and secret detection into a single automated workflow — delivering the depth of a manual pentest at the speed of CI/CD.
Traditional penetration testing takes weeks to schedule, days to execute, and delivers a static PDF that's outdated before the ink dries. LaunchSafe runs continuously, finds vulnerabilities in minutes, and integrates directly into your development workflow with auto-fix pull requests, real-time Slack alerts, and one-click Jira/Linear tickets.
## Why LaunchSafe
**For engineering teams**, LaunchSafe eliminates the security bottleneck. Instead of waiting for an annual pentest or hiring expensive consultants, your team gets continuous visibility into vulnerabilities — with actionable remediation guidance and automated fixes.
**For solo builders and vibe coders**, LaunchSafe is the security expert you don't have on the team. When you're shipping fast with AI-generated code, it's easy to ship vulnerabilities you didn't know were there — leaked secrets, injection flaws, broken auth. LaunchSafe hacks your app like a real attacker would, then hands you the fix as a pull request, so you can keep moving without becoming a security expert first.
**For security teams**, LaunchSafe handles the repetitive work — scanning for OWASP Top 10, checking dependencies for CVEs, finding hardcoded secrets — so your security engineers can focus on architecture reviews, threat modeling, and complex logic bugs that require human judgment.
**For compliance**, LaunchSafe generates detailed reports with CVSS scores, CWE references, and remediation evidence — useful supporting evidence for your SOC 2, PCI DSS, and ISO 27001 programs, with continuous testing rather than point-in-time assessments.
## How it works
LaunchSafe operates in five phases, mirroring the methodology of a professional penetration tester:
LaunchSafe maps your application's attack surface — endpoints, parameters, authentication flows, and technology stack. For white-box scans, it parses your source code into an abstract syntax tree for deep analysis.
The AI engine runs thousands of test cases across multiple scanning modules simultaneously. Static analysis finds code-level flaws. Dynamic testing probes your running application. Dependency scanning checks every package against vulnerability databases.
Unlike simple scanners that report theoretical risks, LaunchSafe attempts to exploit discovered vulnerabilities to confirm they're real. A SQL injection isn't just flagged — it's tested with actual payloads to prove data extraction is possible.
The engine analyzes how individual vulnerabilities can be combined into attack chains. A medium-severity SSRF combined with a low-severity information disclosure might create a critical-severity path to internal systems.
Every finding includes a detailed description, proof-of-concept evidence, CVSS score, and specific remediation steps with code examples. For supported vulnerability types, LaunchSafe opens a pull request with the fix already applied.
## Scanning modules
Analyzes your source code without executing it. Finds injection flaws, insecure deserialization, broken access control, cryptographic weaknesses, and hundreds of other vulnerability patterns across 20+ languages.
Tests your running application from the outside. Crawls every endpoint, submits malicious payloads, and analyzes responses to find XSS, SQL injection, authentication bypass, SSRF, and other runtime vulnerabilities.
Checks every dependency in your lockfile against the National Vulnerability Database (NVD), GitHub Advisory Database, and OSV. Identifies vulnerable packages, suggests safe upgrade paths, and opens PRs to update them.
Scans your codebase for hardcoded API keys, database passwords, JWT secrets, cloud credentials, and 700+ other secret patterns. Includes entropy analysis to catch custom secrets that don't match known patterns.
Generates malformed, boundary, and adversarial inputs for your API endpoints. Discovers crashes, unhandled exceptions, authentication bypasses, and data validation failures that traditional scanners miss.
Logs into your application using provided credentials and tests authenticated routes. Finds broken access control, privilege escalation, and IDOR vulnerabilities that are invisible to unauthenticated scanners.
## Architecture
Every scan runs in a **dedicated, ephemeral Kali Linux sandbox**. Your source code is cloned into an isolated container, tested, and then the entire environment is destroyed. No two scans share infrastructure. All data is encrypted at rest with AES-256 and in transit with TLS 1.3.
LaunchSafe never stores your source code beyond the duration of a scan. Findings, reports, and scan metadata are retained for the duration of your subscription and deleted within 30 days of account termination.
## Integrations
LaunchSafe fits into your existing workflow:
| Integration | What it does |
| ------------------- | --------------------------------------------------------------------- |
| **GitHub** | Clone repos for scanning, open auto-fix PRs, comment on pull requests |
| **Slack** | Real-time notifications for scan events and critical findings |
| **Jira** | Create tickets from findings with severity-based priority mapping |
| **Linear** | Create issues from findings with automatic priority assignment |
| **Scheduled scans** | Run recurring scans automatically on a daily or weekly schedule |
## Getting started
Go from zero to your first scan in under 5 minutes.
Understand white-box, black-box, and hybrid scanning.