Capabilities with the evidence to back them.
Nyxeara is not a checklist of stickers. Every capability below is a working surface of the platform, described in the language we actually use. If a check does not exist, we do not claim it.
Shadow API discovery and attack-surface enumeration
Nyxeara maps the surfaces conventional inventories miss — undocumented endpoints, OpenAPI/Swagger probes, HAR ingestion, and JavaScript bundle AST extraction. The crawler extracts forms, scripts, and parameters with configurable crawl depth and concurrency. Technology fingerprinting detects the platforms and frameworks actually in use. A dedicated special-path probe list covers configuration exposure — dotenv files, git directories, admin panels, API endpoints, debug paths, backup files, and log files.
SQL injection engineered per database engine
Injection payloads engineered per database engine (MySQL, MSSQL, PostgreSQL, SQLite, Oracle, ODBC), with response fingerprinting to confirm each vector rather than guess. Error-based, time-based, boolean blind, and UNION techniques are all implemented. Authentication-aware testing is built in.
WAF detection, evasion, and defense rule generation
A dedicated WAF engine detects, fingerprints, and evades web application firewalls. The engine identifies the WAF type, generates evasion payload variants (encoding, case mutation, parser-aware), monitors a circuit breaker for block detection, and can generate defense WAF rules from scan findings. Accessible through a dedicated control surface.
Out-of-band application security testing with callback capture
Detect blind and deferred vulnerabilities through configurable OAST callback listeners. When an application does not respond in-band (blind SSRF, XXE, SQLi, RCE), Nyxeara listens for the signal it sends. The collaborator system generates callback URLs, polls for interactions on an interval, and displays source IP, method, path, and protocol for every captured callback.
Transparent verification with cryptographic evidence integrity
Verification in Nyxeara is a lifecycle state, not a scanner's claim. A finding carries its confidence and the basis for it (detector-recorded, investigator-recorded, or defaulted), and the platform derives a verification verdict from persisted evidence and your triage actions — never from the detector firing. Every finding carries a SHA-256 integrity digest over the finding plus its evidence linkage. Evidence passes through a redaction pipeline before leaving the server.
Attack-chain analysis
Individual findings become sequences. Nyxeara links steps that compound into a genuine exploit path, so you understand impact, not just symptoms.
Evidence Vault
Proof is captured at collection time and stored per finding: the tool, the target, a persisted evidence body and a SHA-256 integrity digest over the finding plus its evidence linkage. You can audit exactly what was tested, when, and how — without a claimed proof chain behind it.
CI/CD gates and SARIF
SARIF 2.1.0 export, GitHub Code Scanning, severity gates, baseline comparison for regression detection, and signed webhooks. Security lands in the pipeline where the engineers are, with results gated on severity and evidence completeness — not on an unverifiable 'verified' flag.
Workflow automation engine
Nyxeara includes a full workflow automation engine with declarative node types for input, data transformation, logic, investigation actions, and control flow, persistent in-process execution, wave-by-wave scheduling with bounded concurrency, human approval gates, checkpoint-and-resume support, failure strategies (stop/continue/retry/skip), and secret injection at execution time. Workflows progress through draft, published, and archived lifecycle states.
AI analysis and investigation platform
The AI analysis engine produces evidence-grounded observations where every factual claim carries evidence references. Recommendations reference only real tools from the tool registry. The investigation platform supports entity normalization, finding lifecycle management that separates a scanner hypothesis from a verified result, deterministic correlation from shared values, conflict detection, relationship mapping, timeline reconstruction, and full access control with sharing.
CLI, REST API, webhooks, and API key management
A full CLI with device auth flow, binary integrity checking, and device fingerprint binding provides access to tools, investigations, findings, evidence, and workflows. The REST API returns structured response envelopes across the full route surface. The webhook engine emits platform events with delivery tracking, retry, and HMAC-SHA256 signing. API keys use the nx_ prefix with SHA-256 hashing, scopes, and expiration.
Report builder with PDF, HTML, JSON, and CSV export
Professional report builder supports templates, sections, customizable branding, and export in PDF, HTML, JSON, and CSV formats with automatic secret pattern redaction in exports.
Measure against your stack.
Compare plans, or take the platform to a real target and judge it on evidence.