FlawPilot
Roadmap

What's next for FlawPilot

Today FlawPilot scans publicly accessible signals and ships a free, prioritized report. Here's what we're building next. Drop us a line if any of it is interesting to you. We use real demand to decide what gets shipped first.

  1. Live now

    Scheduled scans

    Scans that run on their own, on your schedule

    Weekly schedulemon · wed · fri
    M
    T
    W
    T
    F
    S
    S
    Today92+3
    Fri89+1
    Wed88-2
    Next run in 2 days

    Set a cadence once and let it run. FlawPilot rescans your site or repository on the days you choose, keeps the history against the same property, and tells you when a score moves - so a regression surfaces the week it lands instead of the next time someone remembers to check.

    • Quick scans, Site Health crawls, and code scans on a daily, weekly, or monthly cadence
    • Email alerts when a score drops or new critical or high findings appear
    • Pause, resume, or run on demand at any time
    Start scheduling scansLearn more
  2. Coming soon

    Team notifications

    Findings land where your team already talks

    #eng-alertsslack

    Security score dropped 74 → 61

    2 new critical findings on example.com

    Scan complete - no new issues

    staging.example.com · 2m ago

    Google ChatTeamsEmail

    Send scan results into the channel your team lives in. Connect Slack, Google Chat, Microsoft Teams, or email and choose what is worth interrupting for - every completed scan, or only a new critical finding - so the people who fix things hear about them without opening a dashboard.

    • Slack, Google Chat, Microsoft Teams, and email
    • Choose the threshold: every scan, or only new critical findings
    • Per-channel routing so each team sees only its own properties
  3. Coming soon

    Webhooks

    Every scan event, sent straight to your own systems

    POST hooks.example.comsigned
    scan.completed200142ms
    badge.updated20098ms
    scan.failed503retry 5m

    webhook-signature: v1,K3rQ9x…

    Point FlawPilot at your own endpoints and it posts a signed event the moment something happens - a website or code scan finishes or fails, a pentest changes status, a schedule is paused, a badge moves. Each endpoint picks its events and projects, and failed deliveries retry on their own, so your tooling stays in sync without polling.

    • Choose the events and projects each endpoint receives
    • Signed to the Standard Webhooks spec, with secret rotation
    • Automatic retries, a delivery log, and one-click resend
  4. Live now

    CI/CD & MCP

    Scan from your pipeline, or straight from your AI tools

    Pull request #482ci
    build
    scan
    deploy
    Security+2
    Performance0
    Infrastructure+1
    SEO-1
    No new issues - build passed

    Wire FlawPilot into the places you already work. Run a scan on every pull request and fail the build when something regresses, or connect through MCP so your AI assistant can trigger scans and read findings without leaving the editor.

    • Scan on every pull request, block regressions
    • MCP server so AI assistants can scan and read findings
    • API for your own automation
    Get access to dashboard nowLearn more
  5. Coming soon

    AI-assisted pentesting

    Pentest depth, reached faster

    Attack path3 chained
    1. Exposed /api/debuglow
    2. Leaks internal hostlow
    3. Admin panel reachablecrit

    2 low findings chain into 1 critical path

    Chain findings the way an attacker would. AI-assisted testing probes beyond a single request - following an exposed endpoint into the data behind it, and testing whether two low-severity issues combine into one real path in - then hands a human tester the trail so the report still carries a person’s judgement.

    • Chained exploit paths across findings, not isolated checks
    • Business-logic probing on authenticated flows
    • Every reported finding confirmed by a human tester
  6. Coming soon

    Marketplace support

    Install FlawPilot where your site already lives

    Marketplace1-click
    Your platformInstallInstalled
    Another platformInstall
    Site connected automatically
    No API keys to copy
    First scan starts on install

    One-click installs on the platforms you already build on. Add FlawPilot from your platform’s marketplace and it connects itself - no keys to copy, no config to write - so scanning starts with the site you already have.

    • One-click install, no manual setup
    • Listings on the major platform marketplaces
    • Scans wired to your existing project automatically

Get early access before everyone else

Join the waitlist to unlock these features first, plus founding-member perks and a say in what we build next. One email when it ships, nothing in between.

Featured on