Coverage
Depth across the attack surface
Syndicate doesn't stop at the surface. It tests the classes of vulnerability that matter — and chains them the way a real attacker would.
8 vulnerability classesCVSS 1–10 scale0 false-positive policy
ClassExamplesChainedSeverity
InjectionSQLi · command · template · NoSQL✓Critical
Broken access controlIDOR · privilege escalation · forced browsing✓Critical
Authentication & sessionsweak flows · token handling · fixation✓High
Business logic abuseworkflow & state-machine flaws✓High
API securityREST + GraphQL · mass assignment · BOLA✓High
SSRF & request forgerySSRF · CSRF · open redirect✓High
Client-side & XSSreflected · stored · DOM-based—Medium
Secrets & misconfigurationexposed keys · headers · insecure defaults—Medium
At a glance
Class severity distribution
Critical2 classes
High4 classes
Medium2 classes
Honest scope
What Syndicate doesn't do
We'd rather be precise about scope than overpromise. Syndicate focuses on application-layer security.
- —Not a replacement for human red-team engagements on hardware, physical, or social-engineering vectors.
- —Not a network/infrastructure scanner — we focus on the application, its APIs, and its logic.
- —Not a compliance checkbox tool — findings are real exploits, not policy mappings.
8
vuln classes
6
actively chained
1–10
CVSS scale
0%
false positives
Ready when you are
Find what others miss
See the full attack surface assessed against the classes that actually get exploited.
8
classes
100%
verified
0
noise