Static code analysis
Semgrep searches the source code for vulnerabilities such as injection, insecure deserialization or broken access control; the LLM reviews the hits in context.
Back to VamiAppSec
Halloween Special 2026
VamiAppSec × Paranoid Lab
We shed light on your code – and on the dark web.
An agentic white-box security test and 30 days of dark web monitoring – free of charge.
For Halloween, we test one application of your choice from the inside with VamiAppSec, free of charge: SAST, SCA, dependency and secrets scanning, DAST with VamiDAST – and we generate the SBOM along the way. In parallel, our partner Paranoid Lab monitors the dark web for 30 days for leaked credentials and secrets of your organization, such as API or LLM tokens. We present the results in a 60-minute workshop as a management presentation.
- €0
- free, no obligation
- 60 min
- online workshop
- 30 days
- dark web monitoring
- Until 30 Nov
- requests · limited capacity
At a glance
One special, two perspectives
The VamiAppSec Halloween Special is a free, no-obligation offer from VamiSec GmbH for companies and organizations: an agentic white-box security test of one application with SAST, SCA, dependency and secrets scanning, DAST and SBOM generation – combined with 30 days of dark web monitoring for leaked credentials and secrets, together with our partner Paranoid Lab. We present the results in a 60-minute workshop as a management presentation. Requests are possible until 30 November 2026.
- From the inside
- Agentic white-box test of one application with VamiAppSec
- From the outside
- 30 days of dark web monitoring with Paranoid Lab
- Result
- Management presentation, list of findings and SBOM
- Format
- 60-minute workshop via video conference
- Cost
- Free of charge, no obligation, no subscription
- Requests
- Until 30 November 2026, limited capacity
01 · From the inside · VamiAppSec
Agentic white-box testing: your code in full light.
VamiAppSec orchestrates the checks in one pipeline, normalizes the results and merges duplicates. The language model of your choice enriches the findings, assesses for dependencies whether the vulnerable code is reachable and suggests fixes. It does not act autonomously: our team reviews the results, your team decides.
Dependencies and open source
Grype and Trivy match direct and transitive dependencies against NVD, OSV, EPSS and CISA KEV; the LLM assesses whether the vulnerable code path is reachable in your application.
Grype
Secrets in the code
Gitleaks finds API keys, tokens, passwords and private keys – including those for LLM services such as OpenAI or Anthropic – in the code and, with repository access, in the Git history.
GitleaksDynamic tests of the running application
VamiDAST tests the web application and APIs along the OWASP Top 10 and the OWASP API Security Top 10, including behind the login – only against authorized targets. A deterministic engine steers; the LLM advises in exactly three places.
VamiDASTInfrastructure and containers
Where available, Checkov and Trivy also check Terraform, Kubernetes manifests, Dockerfiles and container images for misconfigurations and vulnerabilities.
Software bill of materials included
Syft generates the SBOM of your application in CycloneDX or SPDX format – matched against actively exploited vulnerabilities (CISA KEV) and prioritized with EPSS. A solid basis for your obligations under the CRA.
Syft
SPDXWhat you get
Findings mapped to OWASP, prioritized by risk and with fix suggestions for your development team – plus the SBOM as a file.
What we need
Read access to a repository in GitLab, GitHub, Azure DevOps or Bitbucket – or a code export. For DAST, a reachable test or staging URL, test accounts if needed, and your written authorization.
Qwen3.8
LLM of your choice: the local Qwen3.8 in VamiSec's data center in Sankt Augustin, Anthropic, OpenAI or your own model. No AI training on customer data.
02 · From the outside · Paranoid Lab
Dark web monitoring: what is out there about you.
Free for 30 days: our partner Paranoid Lab searches infostealer logs, combo lists, marketplaces, forums and Telegram channels for leaked credentials and secrets of your organization. VamiSec analysts review every finding and derive concrete measures.
Leaked credentials
Logins with your domains and email addresses – including those for developer, cloud and AI platforms such as GitHub, GitLab or the consoles of LLM providers, where API tokens can be created.
API and LLM tokens
Secrets such as API and LLM tokens, session cookies or SSH keys from leaks and infostealer logs – searched for via your domains and custom keywords, such as product or project names.
Sources scanners cannot reach
More than 100 dark web marketplaces, more than 200 forums and more than 200,000 Telegram channels, plus infostealer logs, combo lists and breach data.
Baseline report and triage
After about 14 days you receive the baseline report: what is already circulating about your organization, prioritized by criticality – every finding reviewed by VamiSec analysts, with a concrete measure.
What we need Your domains, optionally the email addresses of key people, and custom keywords – only for assets you lawfully own. A data processing agreement with VamiSec is part of it.
The monitoring ends automatically after 30 days – no subscription, no cancellation needed. If you want to continue, you can switch to our managed service.
Managed dark web monitoring with Paranoid Lab
03 · Inside and outside
Together, they show what to do first.
A secret in the code is a finding. If the same access also turns up on the dark web, it goes straight to the top of the list. That is why we bring both perspectives together.
-
In the code
Secrets scanning finds keys and tokens in the code and the Git history.
-
On the dark web
Paranoid Lab finds leaked credentials, cookies and tokens of your organization.
-
Your rotation list
Which keys, tokens and accesses you should replace right away – and which hardening makes sense afterwards.
Always included
Results that fit your board's agenda.
In the 60-minute workshop, we present the inside and outside results as a management presentation – concise, clear and with decision-ready recommendations. You receive the slides as a PDF afterwards.
- 01
Situation on one page
Where your application and your organization stand – clear even without a technical background.
- 02
Findings by risk
Code, dependencies, runtime and dark web – prioritized by likelihood and impact.
- 03
Rotation and action plan
Immediate measures such as replacing leaked secrets, the next 90 days and strategic steps.
- 04
Effort and ownership
A rough estimate of the effort and who should take on what.
- 05
Next steps
What your team can implement itself – and where support makes sense.
For your development team, in addition: the list of findings mapped to OWASP and the SBOM as a file.
How it works
Five steps to your measures.
- 12 minutes
Send your request
Fill in the form. We will get back to you promptly for a short alignment call.
- 2about 15 minutes
Align briefly
We clarify the application, scope and date, with an NDA on request. For DAST and dark web monitoring we obtain your written authorization; you choose the LLM.
- 3in advance
Testing and monitoring
VamiAppSec tests the code and the running application, Paranoid Lab starts the monitoring. The baseline report is ready after about 14 days.
- 460 minutes
Workshop
Online via video conference: we present the inside and outside results and answer your questions.
- 5afterwards
Implement measures
You receive the presentation, the list of findings and the SBOM. The monitoring ends automatically after 30 days – you decide what happens next.
Fair and transparent
The conditions
- Free of charge and without obligation – no follow-up commitment, no subscription. The dark web monitoring ends automatically after 30 days.
- For companies and organizations, one application per organization. Public bodies should check in advance whether their rules allow them to accept a free service.
- Requests until 30 November 2026; testing, monitoring and the workshop may also take place afterwards. Capacity is limited: we allocate slots in the order in which requests are received. If it is exhausted, we will let you know.
- DAST and dark web monitoring only with written authorization and only for systems, domains and data you are entitled to authorize. DAST preferably against test or staging environments; production systems only in Passive or Safe mode, without load or DoS tests.
- The results are an initial assessment based on the authorized scope. They do not claim to be complete and replace neither an audit nor a penetration test.
- Confidential, with an NDA on request. We agree in advance how your code is handled and deleted; only the people you name receive the results.
- VamiAppSec runs on T Cloud Public, exclusively in German data centers. You choose the language model: the local Qwen3.8 in VamiSec's data center in Sankt Augustin, Anthropic, OpenAI or your own model. No AI training on customer data.
- The dark web monitoring runs on the platform of our partner Paranoid Lab; for this, we pass on the authorized domains, email addresses and keywords. Your contractual partner and point of contact is VamiSec.
IT security and compliance without AI is a vulnerability.
Behind VamiAppSec is the VamiSec team: security testing, secure SDLC and audit from a single source – ISO/IEC 27001 certified ourselves.
Request
Claim your Halloween Special.
A few details are enough. We clarify the rest in the short alignment call.
- Nothing scary: free, no subscription, no follow-up commitment
- Results to keep: management presentation, list of findings and SBOM
- Confidential – with an NDA on request
Halloween Special
Request for free
Required fields are marked with *. We will get back to you promptly for a short alignment call.
Thank you – your request has been received.
You will shortly receive a confirmation by email, and we will get back to you promptly for the short alignment call.
Frequently asked questions
Good to know
Is the Halloween Special really free?
Yes. The white-box test, 30 days of dark web monitoring, the workshop and the management presentation are free of charge and without obligation. There is no subscription; the monitoring ends automatically after 30 days. A follow-up order is not a prerequisite.
What is agentic about the white-box test?
VamiAppSec orchestrates the scanners in one pipeline, normalizes the results and merges duplicates. The language model of your choice enriches the findings, assesses for dependencies whether the vulnerable code is reachable and suggests fixes. It does not act autonomously: our team reviews the results before we present them to you.
How much effort is it for our team?
Very little: an alignment call of about 15 minutes, read access or a code export, a test URL with authorization for DAST, a short list of assets for the monitoring – and the 60-minute workshop. We take care of testing and analysis.
What happens to our source code?
We use the access exclusively for the test and agree in advance how the code is handled and deleted, with an NDA on request. VamiAppSec runs on T Cloud Public, exclusively in German data centers. With the local Qwen3.8 in VamiSec's data center in Sankt Augustin, the AI processing stays in Germany too. We do not use customer data as training data.
Why do you need written authorization?
DAST sends requests to your running application, and the monitoring specifically searches for your domains and email addresses. We do both only with the consent of those entitled to authorize it. The authorization sets the targets, time frame and mode bindingly.
How does Paranoid Lab find leaked API or LLM tokens?
Paranoid Lab analyzes infostealer logs, combo lists, marketplaces, forums and Telegram channels and matches them against your domains, email addresses and keywords. This reveals logins to developer, cloud and LLM platforms where tokens can be created, as well as session cookies and finds that match your keywords. There is no guarantee of finding every leaked secret – which is why we combine the outside view with secrets scanning in your code.
Is dark web monitoring legal?
Yes, and purely defensive. Only data that criminals have already published or offered for sale is monitored, and only for assets you lawfully own. There is no hacking, no purchasing for attacks and no harm to third parties.
What happens if the monitoring finds something?
VamiSec analysts review and prioritize every finding. You receive a concrete recommendation, such as a password reset, session invalidation or rotating a token. We report critical findings to you promptly, not just in the workshop.
Who should attend the workshop?
Ideally someone from management and the people responsible, such as the CISO, the information security officer, the head of development or product security. The management presentation is understandable without a technical background.
Until when can I send a request?
Until 30 November 2026. The deadline applies to your request – we agree the test, monitoring and workshop with you, and they may also take place later. Capacity is limited: we allocate slots in the order in which requests are received.
All treats, no tricks
Light on your code. Request for free by 30 November.
A white-box test from the inside, 30 days of dark web monitoring from the outside and a management presentation that shows what to do now.