Security is the product.
Onyx is an offensive tool, so safety isn’t a feature bolted on — it’s the foundation. It attacks only targets you’ve proven you own, guards against SSRF, encrypts every secret at rest, and redacts sensitive evidence before it’s ever stored. Here’s exactly how.
Aggressive on targets. Safe by design.
Onyx only ever hits the API you actually own, and it does so within strict guardrails.
You must prove you own a target
Before Onyx fires a single payload, you verify domain ownership — either a probe file at /.well-known/onyx-verify.txt or a DNS TXT record. Unverified domains can't be scanned.
SSRF guard on every request
Every target URL is DNS-resolved and checked before use. Loopback, private, link-local, CGNAT, cloud-metadata (169.254.169.254), and IPv4-mapped IPv6 addresses are blocked — and re-vetted on a short TTL to defeat DNS rebinding.
Hard request timeouts
Every outbound attack request is aborted after 10 seconds, so a slow or hostile endpoint can't tie up the engine.
Paced, rate-limited, quota-bounded
Work is queued and evenly paced (bounded concurrency, ~30 requests/sec per run), auth and scan endpoints are IP rate-limited, and each plan has monthly run and endpoint quotas — so scans stay controlled.
Your secrets stay secret.
Auth secrets encrypted at rest
Credentials in your auth recipes (tokens, API keys, OAuth secrets, passwords) are encrypted with AES-256-GCM — authenticated encryption — before they touch the database.
API tokens are hashed, not stored
CLI/API tokens are kept only as SHA-256 hashes; the plaintext is shown once at creation and never persisted. Tokens can be revoked at any time.
Response evidence is redacted
Before any response snippet is stored or streamed to your dashboard, secrets — bearer tokens, API keys, passwords — are masked to ***REDACTED***, so evidence stays useful without persisting real credentials.
Credentials never logged
Secrets are kept out of application logs and error messages by design.
Sign in with confidence.
JWT sessions, algorithm-pinned
Session tokens are signed and verified with HS256, with the algorithm pinned on verification to prevent algorithm-confusion attacks.
Passwords hashed with bcrypt
Passwords are stored as bcrypt hashes (cost factor 12) — never in plaintext.
OAuth sign-in
Prefer not to manage a password? Sign in with Google or GitHub.
Scoped, revocable API tokens
API tokens act as you for the CLI and CI, and can be revoked instantly from Settings the moment one is no longer needed.
Built on managed, modern infrastructure.
Onyx runs on managed cloud infrastructure with a managed PostgreSQL database and a Redis-backed job queue that isolates and paces attack work. Attack traffic runs through queued workers behind the SSRF guard, separate from your account data. We don’t publish exact versions, hostnames, or internal topology here — by design.
Honest about where we are.
Onyx is not SOC 2 or ISO 27001 certified today, and we won’t claim otherwise. Formal compliance is on our roadmap; until then, this page is our transparent account of the controls that are actually in place. If you need specific assurances for a security review, get in touch.
Found a bug in Onyx itself?
We welcome coordinated disclosure. If you find a vulnerability in Onyx, please report it privately and give us a chance to fix it before going public — we’ll work with you on a timeline.