Odin

Read Odin security findings and remediation, link fix pull requests and track retests.

View on borghq.io

Hosted MCP Server

npx add-mcp 'https://odin.borghq.io/api/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

IDOR Testing for APIs: How to Find Broken Object Access

Offensive security, continuously deployed.

Find and fix real vulnerabilities across code, applications, and infrastructure.

Review a PR

Less waiting. Fewer blind spots.

Find vulnerabilities as your systems change, not months later.

Then move straight from finding to a verified fix.

External Attack Surface

Attack Surface Monitoring

We track domains, services, and cloud systems exposed to the internet, and notice when something new appears.

  • Domains and subdomains
  • Exposed services
  • Cloud and infrastructure
  • New external assets

Applications & APIs

Whitebox Pentesting

We test your applications and APIs with enough understanding of the product to find issues that scanners miss.

  • Authentication and authorization
  • API security
  • Business logic
  • Sensitive data exposure

Code Changes

PR Security Reviews

Security-sensitive changes reviewed before they reach production.

  • Access control changes
  • Authentication flows
  • Sensitive APIs
  • High-risk application logic

Start focused. Expand from there.

Run individual capabilities directly, or combine them into continuous coverage across your environment.

Self-serve when you want it. Expert-led when you need it.

Security Posture

24h7d30d90d

82

Health score

14

Open findings

23

Resolved (30d)

147

Monitored Assets

3

Active scans

Finding severity breakdown

[16 total]

3 CRITICAL

5 HIGH

6 MEDIUM

2 LOW

RECENT ACTIVITY

  • Critical IDOR found in /api/users/:id 19m ago
  • Pentest run #48 completed - 3 findings 1h ago
  • staging.acme.com discovered via CAD 3h ago
  • 2 findings marked as Solved by Alexander. 1d ago

Automation

Active Workflow

Trigger

New finding

on detection

Filter

Severity ≥ High

critical · high

Action

Notify team

Slack · Jira

Connected Apps

  • Jira Integration Vulnerability Tracking active
  • GitHub Issues Vulnerability TrackingWhitebox Pentests active
  • Linear Integration Vulnerability Tracking active
  • Slack Notifications Collaboration active

79% of findings

are in auth, API & business logic

Beyond scanner findings

While scanners chase noise, Borg targets vulnerabilities that lead to real impact.

What Borg Uncovers

Real vulnerability classes from production environments.

Auth & Session BugsAccess Control & IDORsAPI & Business LogicExposed Surfaces & Cloud

Every Finding Verified

Every vulnerability is confirmed with evidence and reproduction steps before it reaches your team.

700+Verified findings across over 42 organizations

Self-serveUse Borg directly.PRs, pentests, attack surface

Expert-ledWork with our team.Continuous offensive security

Two ways to use Borg

Run it yourself, or work with our team.

Coverage

Traditional approach

The gap

Borg

Code

SAST and dependency scanning

Exploitability and business logic

Review high-risk changes before they ship

Applications

DAST and automated scanning

Real application context

Test workflows for exploitable vulnerabilities

Pentesting

Deep point-in-time testing

Coverage between engagements

Test continuously and verify fixes

Borg