How it works
How PreHack works
From push to Pull Request: an AI pentester that tests your app like an attacker, proves the flaw, and brings the fix.
In one sentence
PreHack is an autonomous AI pentester. You connect your GitHub repository once; from there it monitors every change, attacks your application in an isolated environment to find security flaws, proves each flaw with a real break-in, and hands back the fix as a Pull Request that you review and approve. No human opens your code: only the AI.
A pentester (from penetration test) is the professional who attacks a system on purpose, with authorization, to find the open door before a real attacker does. PreHack does that work with AI agents, continuously, at the pace your code changes.
The principle: prove, never just suspect
Most security tools flag suspicions: “this might be a problem.” The result is a flood of alerts, most of them false positives, that someone on your team has to triage one by one. PreHack starts from the opposite principle.
Nothing becomes an alert without a proof of concept: a real break-in, run in an isolated environment, that shows step by step how the flaw is exploited. If it can't be proven by exploiting it, it isn't reported. That's what eliminates the false alarm, you only look at what's real.
The step by step, from push to Pull Request
1. You connect GitHub (and that is the authorization)
It all starts with one click: you connect the repository you want to protect. Connecting GitHub is your explicit permission for PreHack to test that code, penetration testing only happens against what's yours, with your consent. You grant and revoke that access whenever you want, straight from GitHub, without going through us.
2. PreHack starts monitoring 24/7
PreHack is an AI agent. Connected to your GitHub, it follows every push and every deploy and notices what changed the moment it changes. There's no dashboard to keep watching and no routine to maintain: after the first click, the work is its own.
3. On every change, the scan fires on its own
The scan (the security sweep) runs automatically on every code change, especially on every deploy, which is exactly when new flaws tend to slip in. You can also trigger a scan on the spot, whenever you want, but you don't have to: continuous is the default.
4. AI agents attack your app in an isolated sandbox
The scan doesn't read your code from a distance looking for suspicious patterns. Specialized AI agents attack your application with the same tools a hacker would use, inside a sandbox, an isolated, disposable environment separate from your production. Each agent focuses on one type of attack, and they work together to cover the target.
5. Every flaw found becomes a proof of concept
When an agent finds a gap, it doesn't stop at “found it.” It builds and runs the real break-in that exploits that gap, right there in the sandbox, and attaches that step by step as proof. A flaw without proof goes no further. This mandatory validation is what separates a real finding from a guess.
6. The fix arrives as a Pull Request
For each proven flaw, PreHack writes a tailored fix and opens a Pull Request in your repository, with the fix on one side and the proof of the flaw on the other. You review that PR like you'd review any teammate's: you read it, understand it, approve it, and merge. Nothing is touched in your code without your approval.
7. Through MCP, the AI you already use pulls the fix
You don't have to install or maintain security skills in your own AI. The AI you already use day to day talks to PreHack over MCP and pulls the fix straight into your workflow, without leaving the environment where you already code. PreHack takes the security topic off your plate; your AI just receives the finished result.
Why the proof changes everything
AI-generated code reaches production faster than any team can review it, and that speed creates gaps. The people who built these tools recognize the point: Ty Sbano, CISO at Vercel, sums it up: “AI tools are trained to produce code that works, not code that's secure” (source: Vercel). An analysis by Veracode measured the size of the problem: AI-generated code can have up to 2.74× more flaws than code written by humans (source: Veracode).
In a scenario like this, more alerts don't help, they get in the way. What matters is separating what's real from what's noise and arriving with the fix already in hand. That's why PreHack only reports what it managed to break into and delivers the fix alongside it: your time goes to deciding, not to investigating every warning.
Why AI-written code needs this
AI writes a lot of code, fast. Public research shows how much of it ships insecure.
Across 80 coding tasks run on more than 100 large language models, 45% of the AI-generated code introduced a vulnerability from the OWASP Top 10, the most critical web application risks, in Veracode's 2025 GenAI Code Security Report.
The same report found the models failed to write safe code against cross-site scripting 86% of the time, and against log injection 88% of the time. These are exactly the flaws an autonomous pentester proves and fixes on every push.
Security and control stay with you
- Only the AI reads your code. No human opens your repository at any point.
- You approve everything. Fixes arrive as Pull Requests; nothing enters your code without your merge.
- Revocable access. You grant and cut GitHub access whenever you want, straight from their platform.
- Active testing is only against what's yours, with your explicit permission, and runs isolated in a sandbox.
- Your code doesn't become training. It's analyzed to find flaws, never used to train any model, neither ours nor anyone else's.
- Managed credit. No API keys to manage — Plug & Play includes a credit pool and PreHack pays the AI provider, with every scan's cost shown on your balance.
Quick glossary
- Push / deploy
- A push sends a code change to the repository; a deploy puts that change live. These are the moments when new flaws tend to slip in.
- Pull Request (PR)
- A proposed code change, opened for review before it actually lands. This is how PreHack delivers each fix: you review and approve.
- Sandbox
- An isolated, disposable environment where the attacks happen, separate from your production. The test break-in stays contained there.
- Proof of concept (PoC)
- The practical demonstration that a flaw is really exploitable, the step by step of the break-in, not a guess.
- MCP
- The channel through which the AI you already use talks to PreHack and pulls the fix into your workflow, without you installing anything.
- Managed credit
- No API key needed: Plug & Play includes a credit pool and PreHack pays the AI provider. Every scan shows its cost against your balance, so you keep control of the spend.
See PreHack work on your code
You connect GitHub and PreHack starts watching. Start free with a config scan — no API key, no setup. The full pentest runs on Plug & Play ($29/month), with the AI bill on us.
Start free