StackHawk
DAST that finds, fixes, and verifies exploitable vulnerabilities inside AI coding agents
💬 What is StackHawk?
StackHawk is a dynamic application security testing (DAST) platform built to secure AI-generated code before it ships. It integrates as a skill or plugin inside AI coding agents such as Claude Code, Cursor, Codex, and Antigravity, where the agent runs security scans against a running application, surfaces exploitable findings, and applies code-level fixes. It is designed for engineering and AppSec teams that ship code through agentic workflows and need vulnerabilities closed rather than triaged into a backlog. Distinctively, StackHawk operates inside the agent loop—runtime testing, source-context remediation, and a verification rescan—rather than only producing a vulnerability report. An API skill lets the agent configure scans, policies, and triage autonomously without requiring dedicated security expertise.
Who it's for
Best for: Engineering and AppSec teams at software companies shipping features through AI coding agents
- Securing AI-generated code before it is committed or merged
- Embedding runtime DAST scans into Claude Code, Cursor, Codex, or Antigravity workflows
- Automatically remediating exploitable vulnerabilities instead of filing tickets
- Burning down an existing application security backlog using an AI agent
- Verifying that previously fixed vulnerabilities stay fixed via rescan
Pros & cons
- Closes exploitable vulnerabilities before the PR opens rather than just reporting them
- Native integration with multiple leading AI coding agents via skills and plugins
- Fixes are made with full source context, not generic patches
- Built-in verification rescan confirms the fix actually worked
- Backlog burn-down framing: produces fixes instead of new tickets
- Only the explicitly supported agents (Claude Code, Cursor, Codex, Antigravity) are documented on the site
- Runtime testing requires a running application, which may not fit every repo or language
- Pricing tiers and plan limits are not disclosed on the pages provided
- Positioning assumes teams are already using an AI coding agent as their primary dev loop
Key features
- Runtime DAST scans against a running application
- Integration with AI coding agents (Claude Code, Cursor, Codex, Antigravity)
- Detection of SQL injection, IDOR, and broken authentication, among other vulnerability classes
- Automatic remediation of findings inside the codebase with full source context
- Verification rescan to confirm the vulnerability is gone
- Pre-PR fix loop that closes vulnerabilities before code is committed or merged
- StackHawk API skill for autonomous scan configuration, policy, and triage by the agent
- Backlog burn-down workflow that produces fixes instead of tickets
Pricing
Pricing compared →Prices listed on the StackHawk pricing page: $10/user · $10/mo
Source: stackhawk.com pricing page. Price checked 2026-10-22. Confirm current plans before buying.
💬 Community sentiment (from public reviews)
No third-party reviews found yet. Grade reflects our 2% verification confidence.
💬 StackHawk user reviews (0)
Write a reviewNo reviews yet. Be the first to review!
Trust & safety
Badge for StackHawk
OptionalListing is free and never requires a link. If stackhawk.com links back to this page, the listing earns Partner perks: a higher category rank, a Partner badge on its card, and an ad-free direct “Visit” link. Use any link attributes you like — rel="nofollow" is fine.
Frequently asked
What is StackHawk?
A dynamic application security testing (DAST) platform that runs inside AI coding agents to find, fix, and verify exploitable vulnerabilities before a PR opens.
Which AI coding agents are supported?
StackHawk agent skills and plugins are available for Claude Code, Cursor, Codex, and Antigravity.
Does StackHawk only find vulnerabilities, or does it also fix them?
It finds, fixes, and verifies. The agent calls HawkScan, applies a source-context fix, and rescans to confirm the issue is resolved.
What kinds of vulnerabilities does it cover?
The site calls out SQL injection, IDOR, and broken authentication, and positions the platform broadly as runtime application security testing.
When in the dev workflow does StackHawk run?
Post-commit and pre-PR, so exploitable issues are remediated before a pull request is opened.