Access Control Testing
SakaForge is a PR-preview gate for BOLA/BFLA: two users, live theft, 0% FP, verified fix and signed log straight to Vanta/Drata — CC6.1 turns green without screenshots. For B2B SaaS and fintech under PCI DSS 4.0.1 and DORA.
One-minute setup · no configs · works in GitHub
What it does
Creates owner and attacker in your running app.
A finding counts only if the request returned 200, data leaked, and replay matched.
Prepares a patch and runs 4 roles: owner, attacker, admin, guest.
Streams HMAC proofs to Vanta/Drata — auditor sees green CC6.1.
Results · August 2026
Four numbers that show how well the engine stops others' data from leaking. Each number is from a real run.
false positives
42 checks on clean apps — zero noisy alerts.
real vulnerabilities
across 10 foreign and vulnerable apps, each with behavioral proof.
runs in a row
20 targets, 0 network failures, full pipeline with no manual setup.
auto checks
engine tests pass after every change — from detection to boundaries.
Ordinary scanner
SakaForge
Honest about limits: numbers are real runs on foreign authorized and local apps. 20+ external client projects await owner consent — when they appear, numbers will be replaced with their results.
0% False Positive Contract
Each vulnerability counts only if three conditions coincide. If one fails — we stay silent. That’s why clean apps stay silent and dirty ones get a theft video.
See numbers →Attacker got a response as a regular user. 401/403/404 — not counted.
We compare the response to the owner’s reference: JSON diff of private fields or provable mutation (created/deleted object).
Destructive probes run on freshly created victim resources. The attack is replayed twice identically. One fail = no finding.
controls on clean apps
false positives
signed every step
SLA: found a false positive — we refund the scan. Proof — redacted cURL + audit-trail.jsonl.
Live agent • as in video, but real
One focus at a time. No noise. Hover — pause. Click a dot — switch stage.
Run live check in dashboard →
Live theft on your preview: two users, one theft, cURL proof in 60 sec. No demo call needed.
commit 51dede59 • tree digest 9c1e…a8f3 • HMAC signed • replay 2/2 • < 60s • press ← →
Pricing — your runner pays for compute
Scan runs in your GitHub Actions (ephemeral Docker, clean DB). Our cost — $0.01/PR (LLM patch only) → 85–99% margin. Old $149 plan would burn $121 on active teams.
Overage $0.60/scan. Pilot $5k/4wks → Business $2500/mo. Funnel 50→15→10, cycle 30–45d.
How it works
Four steps. No configs, no babysitting — the engine deploys the check on every PR preview itself.
Your PR creates a preview. SakaForge connects, sees changed files and pins the exact commit.
Registers owner and attacker in the same running app — two real sessions.
Finding only after three conditions: request returned 200, data leaked, replay matched.
Patch is rerun as owner, attacker, admin and guest. All pass — fix goes to PR.
Try it yourself
Sign up and run the live demo: the agent will walk through the check step by step, right in your browser.
Open dashboard →FAQ
No. SakaForge runs on the preview in parallel with CI — never inside it. Hard 180-second budget and delta-only scanning keep it bounded.
A vulnerability is reported only when three conditions hold at once: the request returned 200, private data leaked (or state changed), and the exact attack replayed twice with identical results.
Only via the GitHub App you install or explicit owner consent tied to the exact deployed commit. Public code or URL is not permission.
No. Every run ends with automatic cleanup of created entities, and calls to payment/SMS gateways are mocked.