> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.security/llms.txt
> Use this file to discover all available pages before exploring further.

# AI penetration testing and code security

> Understand Apex by Cantina's code-aware reviews, black box web and API testing, exploit evidence, remediation workflow, and verification of security fixes.

**Apex by Cantina** investigates code and running applications for exploitable vulnerabilities. Findings carry evidence and remediation guidance, and Fix Review checks a proposed patch against the original security finding.

## Choose the testing surface

| Security question | Workflow | Starting point |
| - | - | - |
| Where can an attacker exploit this codebase? | Code-aware repository scan with the system's threat model and context | [Scan manual](https://docs.cantina.security/apex/scan-manual.md) |
| Does a proposed change introduce a vulnerability? | PR Scan scoped to a pull request or merge request | [Current scan manual](https://apex.cantina.security/docs/manual) |
| What can an attacker reach in a running web application or API? | Apex Black black box testing, where enabled for the account | [Current service API and hosted MCP guide](https://apex.cantina.security/docs/apex-api) |
| Does this patch resolve a known vulnerability? | Fix Review against an existing finding | [Fix Review workflow](https://apex.cantina.security/docs/fix-review) |

Code-aware review uses repository access and supporting context. Black box testing investigates a running target from the outside without requiring source-code access. Define the authorized targets, exclusions, and relevant application context before starting a test.

## Work from evidence to a verified fix

1. **Scope:** select the system, code references, or running targets and supply the context needed to evaluate risk.
2. **Investigate:** examine potential weaknesses and the conditions an attacker would need.
3. **Validate:** review the finding's exploit evidence, affected surface, and remediation guidance.
4. **Remediate:** prepare a patch and use the organization's normal code review and release process.
5. **Verify:** run Fix Review for an eligible existing finding and inspect the result against the actual patch.

A verified fix addresses the reviewed finding and checkout. Broader security coverage depends on the tested scope, available context, and the work performed. Read each report's limitations and separate patch verification from deployment.

## Evaluate Apex

* Review the [Apex product overview](https://www.cantina.security/apex) for capabilities and workflow examples.
* Read the [production application field report](https://www.cantina.security/resources/apex-field-report) and [penetration testing benchmark](https://www.cantina.security/blog/ai-vs-human-penetration-test-benchmark), including their methods and limitations.
* Inspect [published disclosures and vendor responses](https://www.cantina.security/disclosures).
* Confirm access, supported inputs, current credit requirements, and integration prerequisites in the [live Apex docs](https://apex.cantina.security/docs).

## Start or automate a workflow

Use [onboarding](https://docs.cantina.security/apex/onboarding.md) for first-time access, [Apex CLI](https://docs.cantina.security/apex/cli.md) for local and coding-agent workflows, or the [service API](https://docs.cantina.security/apex/api.md) for headless integrations. Use [scheduled scans](https://docs.cantina.security/apex/scheduled-scans.md) for recurring workspace coverage.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.