Find, Triage, and Fix
Security Bugs

It’s Simple with StackHawk

Product Hero Image Illustration

How It Works

Illustration - StackHawk Merg Diagram

Automated Scan on Every PR

On every new pull request, a StackHawk scan will run against your application, service, or API to find any newly introduced vulnerabilities from your code or your open source components.

Illustration - Product Scans Screens

Quick Triage of Findings

If alerted of a new security finding, developers have all of the information needed at their fingertips. With clear descriptions of the vulnerability and the request/response details that triggered the finding, developers can take action now or send to an existing team backlog.

Illustration - Product Scan Modal

Simplified Fixes

Developers can copy a cURL command to recreate the request that triggered the finding, leading them right to the bug. With links to fix documentation, remediating security bugs has never been faster.

What StackHawk Tests

As a dynamic testing tool, StackHawk is language agnostic.

Server Side HTML
Single Page Applications
GraphQL APIs
Authenticated Applications

Built on ZAP

StackHawk is proudly built on open source ZAP, the most widely used application security scanner.

With a decade of market leading security testing capabilities and an active open source community, StackHawk leverages scanning technology that security teams trust.

Visit ZAP Website
zapbot image

Fixing Vulnerabilities

Fix Documentation Illustration
Fix Documentation

Push an updated PR quickly with provided links to fix documentation.

cURL Command Recreation Illustration
cURL Command Recreation

Step through code with the same request and find the bug faster.

Smaller Test Units Illustration
Smaller Test Units

Scan every microservice on each PR and spend less time hunting when a finding is surfaced.


Your application security tooling is just another part of your engineering stack. With StackHawk, integrating AppSec into your existing workflows is easy.

Logo - Amazon Code Services
Logo - Azure Pipelines
Logo - Circle CI
Logo - Concourse
Logo - DataDog
Logo - GitLab
Logo - Jenkins
Logo - Jira
Logo -  Slack
Logo - Travis CI
Logo - Atlassian Bamboo
Logo -  Microsoft Teams
...and more

Getting Started

Test Your Application

Get started with a local test:
  • Sign up for an account
  • Build your initial config
  • Kick off a Docker-based scan on the command line
  • Review findings
  • Expand config to include underlying APIs, authenticated scans, and more

Test Google Firing Range

See data from a sample application:
  • Sign up for an account
  • Select Google Firing range sample
  • Review findings
  • Copy config to run your own GFR scan
  • Modify config to test your own application