White-box
Continuous vulnerability scanning for the AI systems in your codebase.
White-box finds vulnerabilities in the AI systems inside your repositories — agents, tool definitions, system prompts, memory, retrieval, MCP connections — and reports them on the pull request that introduced them.
It works from our vulnerability cookbook: a catalogue of exploit patterns specific to AI systems, which grows continuously from findings across client engagements and from runs against open-source repositories.
What it gives the rest of the platform
White-box builds a structural map of every AI system you run: what each one is, which tools it exposes, where its prompts come from, and which code it depends on. That map makes the other products sharper:
Adversarial testing
Attacks are aimed at the tools and ingress points a system actually has, instead of generic payloads.
Guardrail recommendations
We can tell which controls are missing next to which capabilities and suggest guardrails to enforce them.
Your code stays yours
Every analysis runs in an ephemeral sandbox, created for a single event and destroyed when it finishes.
- The sandbox holds one short-lived token, scoped to the single repository being analysed — no other credentials, keys or customer data.
- No shared state between customers. Each run starts from nothing.
- The sandbox can reach the internet for the services it needs, but cannot reach our internal systems. There is nothing to move laterally to.
- We do not keep your source code. The clone lives and dies with the sandbox.
What we do keep is the structural map: file paths, symbol names and the dependencies between them. No source code, encrypted per customer.
Getting started
Install the GitHub App
Install Harbor Agent from our platform. Installation is at the organisation level and requires an organisation owner or an admin of the repositories you want covered.
Choose your repositories
Pick All repositories or Only select repositories. You can change this at any time from GitHub, and we are told immediately when it changes.
Accept the permissions
GitHub shows the exact permission set before you install. We request the minimum needed:
| Permission | Access | Why |
|---|---|---|
| Metadata | Read | Required by GitHub for every app |
| Contents | Read | Clone the repository into the sandbox |
| Pull requests | Write | Post findings on the pull request |
| Checks | Write | Report a pass/fail status on the pull request |
We do not request write access to your code, your workflows, your secrets or your organisation members. White-box never modifies your repository.
Configuration
White-box works out of the box. These are the starting settings:
| Setting | Default |
|---|---|
| Pull requests reviewed | Those targeting your default branch |
| Direct pushes reviewed | None |
| AI systems covered | All discovered systems |
| Paths | All paths |
| Authors | All authors |
| Draft pull requests | Skipped until marked ready for review |
Everything is configured in our platform, per repository or across your organisation:
- Branches — which pull request targets to review, and which branches to review direct pushes to
- Systems — cover every AI system or only selected ones
- Paths — exclude generated code, fixtures or vendored directories
- Authors — skip dependency bots and other automated contributors
- Suppression — accept a finding so it stops reappearing on later pull requests
Wait for the first index
On connection we run the initial index: a sandbox per repository, where an agent maps every AI system, builds a dependency graph for each one, and runs the cookbook against it.
This is the slowest step and it happens once. Everything after it is incremental.
What happens on a pull request
Once indexed, each event is cheap because most changes cannot affect an AI system at all.
A pull request opens or is updated. We check it against your settings — branch, author, paths, draft status.
We compare the changed files against the dependency graph. If no file reaches any AI system, we stop here and post nothing.
We assess whether the change could alter behaviour. Touching a file is not the same as changing what a system does.
We scan the affected systems against the cookbook — only those, not the whole repository.
We post a summary comment in the pull request, and inline comments on the specific lines involved, with severity and the evidence behind each finding.
Force a scan
Comment @harbor scan on any pull request to run White-box regardless of the settings.
Findings include a recommended fix, described in the comment. White-box does not commit changes to your code and does not offer one-click fixes — a security fix should be understood before it is applied.