Finds it. Proves it. Fixes it.
Fifteen production scanners across code, dependencies, containers, IaC, secrets, and cloud — plus an autonomous pentest agent (beta, sharpest on APIs and server-rendered apps) that validates every finding by replaying the exploit and opens the fix PR.
Terminal transcript: fimil scan ./api. semgrep 14 findings. trivy 31 findings. gitleaks 2 findings. + 12 more scanners. deduplicated 47 raw → 9 findings. SQLi api/users.py:84 — exploit replayed 2/2. fix PR #482 opened
what's inside
No adjectives. Just the numbers.
Every number links to the page that proves it.
finds
One scan, every layer.
Fifteen open-source scanners across SAST, SCA, containers, secrets, IaC, DAST, CSPM, and SBOM run as one pipeline. Cross-scanner fingerprinting collapses the same CVE found by Trivy and Grype into a single finding — with every source credited.
How the pipeline worksproves
No finding ships without a working exploit.
The pentest agent doesn't pattern-match — it attacks across 15 vectors, and a validator replays every candidate exploit before it reaches your dashboard. Each confirmed finding exports a PoC and a copy-paste curl reproduction.
Meet the pentest agent- discover IDOR candidate: integer object id
BFS crawl + OpenAPI ingest — 142 routes mapped
GET /api/v1/orders/{id} → 200
- attempt
Cross-account read with a second session
order_id=1337 → 1338 · session B
- validate CONFIRMED: foreign record returned
Exploit replayed before reporting — 2/2 reproductions
- proof advisory fix PR opened
PoC + copy-paste reproduction exported
curl -s 'https://staging.acme.dev/api/v1/orders/1338' -H 'Cookie: session=B···'
fixes
The finding is the pull request.
Semver-aware dependency bumps across 7+ ecosystems, Terraform/CloudFormation/Kubernetes fixes, code fixes from 75+ CWE-specific handlers across eight languages, and advisory fix PRs opened from confirmed pentest findings — each one a ready-to-merge diff.
See the remediation engineone signal
A priority score you can audit.
Not a black box: 70% severity, 15% age, 10% reachability, 5% EPSS. Call-graph reachability looks past direct-vs-transitive to whether the vulnerable function is actually called — and shows you the call chain.
workflow
Meet your code where it lives.
Six ways into the platform — none of them require changing how you ship.
GitHub, GitLab & Bitbucket
OAuth connect, webhooks, PR checks, and commit status on every push.
Notifications
Slack, email, and custom webhooks, with per-user preferences.
CLI
Pre-commit gate and CI integration for shift-left scanning.
MCP server
More than 40 tools so your AI assistant can run scans, triage, and remediation.
Kubernetes operator
Declarative installs and upgrades for self-hosted clusters.
SaaS or self-hosted
Fimil Cloud, or run the whole platform inside your own network.
built on open source
Fifteen scanners. One agent. One orchestrator.
Fimil orchestrates best-in-class open-source scanners — and adds the layers they can't: validation, correlation, and remediation.
pricing
Start free. Pay for what you scan.
AI Pentest is usage-based on paid plans — you pay per confirmed finding, and false positives are credited.
Team
For growing teams
- 10 repositories
- 100 scans/month
- Slack, API access & SBOM export
- AI Pentest — 2 runs/mo
Business
For larger organizations
- 50 repositories
- 500 scans/month
- Auto-triage & auto-fix PRs
- AI Pentest — 10 runs/mo
- Priority support
Get Started Today
Start free with 3 repos. No credit card required. Upgrade when you need more.