v0.7.1 · latest release · updated continuously
Web security audits,
ready for your client.
Iridia examines a web app the way an attacker and a logged-in user see it, then turns what it finds into a report your client can read: business impact, proof for every finding, and how to fix it. Re-tests and monitoring follow when you need them.
- Windows · desktop app
- Windows & Linux · command line
- macOS · planned
- no cloud · no LLMs
Measured on Iridia’s own test lab: a deliberately vulnerable app and its hardened twin.
01How it works
It starts with the audit. The rest is there when you need it.
-
01 · Scan
See what an attacker sees — and what a user sees
Passive and active checks, a real login through CSRF-protected forms, and a two-account check that catches one customer reading another’s data.
$ ird scan shop.example --login-url … -
02 · Report & patch
A report the client reads, a patch the developer pastes
Business impact up top, curl proofs underneath, and ready config for the stack Iridia detected.
$ ird report --format executive-html -
03 · Re-test
Close the job with proof, not a promise
Each finding comes back fixed, still open, or not re-tested — with the reason. Green only when everything was checked again.
$ ird retest baseline.json -
04 · Monitor
Know first when a deploy breaks it again
Scheduled checks per client site. You get an alert only when something new appears or a fixed issue returns.
$ ird monitor run --due
02The report
What your client actually opens
One self-contained HTML file: readable by a founder, checkable by a developer, printable to PDF. Under your brand.
The layout and wording are the real Executive report, generated from a run against our test lab. Client, agency and domain names here are placeholders.
03What ships today
Everything here is in v0.7.1 — no roadmap items
Each of these is built, covered by tests on every change, and in the version you download today.
Client portfolio & monitoring
Clients, their sites, history and an accepted baseline. Checks run on your computer’s scheduler; alerts go to email, Slack or Telegram — only on new findings, a regression, or downtime.
CI gate for GitHub & GitLab
Scan staging after each deploy and fail the job on new findings only. SARIF lands in the Security tab; the engine is a checksum-verified binary.
Honest re-testing
A passive re-scan can’t mark an active finding fixed; a re-scan without the login can’t clear session issues. Exit codes say verified, open or incomplete.
Two-account access checks
Give it two test accounts you own. BOLA/IDOR is flagged only when user B receives user A’s exact object — not just a similar-looking page.
Scans behind the login
Iridia logs in through real forms, including ones with anti-CSRF tokens, then checks session cookies and session fixation.
Patches for their stack
Ready-to-paste fixes for Nginx, Caddy, Next.js, FastAPI and Cloudflare, with the detected stack first.
Attack paths & compliance
Findings chained into attack paths with business impact, tagged CWE, OWASP Top 10:2025, PCI DSS v4.0, GDPR Art. 32 and SOC 2.
Reports under your brand
Executive HTML for the client, Markdown for HackerOne and Bugcrowd, SARIF for GitHub — with your studio’s name and logo.
Local, deterministic, offline
No models, no cloud, no API keys. Client data stays on your machine; even the license is verified offline and carries your name.
Shipping continuously
Every release runs the full test suite and the accuracy bench before it ships.- v0.7.1 · latestAlerts inside the appThe desktop app announces new monitoring results itself and badges the portfolio.
- v0.7Portfolio & monitoringClients, sites, baselines, scheduled checks and alerts by email, Slack or Telegram.
- v0.6CI templates & licensesGitHub Action, GitLab template, a standalone Linux engine and offline license keys.
- v0.5Honest re-testingCoverage-aware re-tests, the fix certificate, and an accuracy bench in CI.
04Why it’s different
Built for the person who signs the audit
Iridia
A typical cloud scanner
The right-hand column describes common practice among hosted scanners, not any one product. Iridia does not replace a manual penetration test.
Freelance auditors
Spend the hours on what needs a human. Iridia does the sweep, the write-up and the re-test.
Web studios
Ship every client site with a security report under your brand — then keep it monitored and sell the follow-up.
Small DevSecOps teams
A CI gate that fails on new findings, SARIF for code scanning, and exit codes your pipeline can read.
Only targets you’re allowed to test
Active checks run only after you prove control of the domain with a DNS TXT record, or declare the scope and accept the rules of engagement. Scheduled monitoring is passive unless you record who authorized more.
$ ird verify client-shop.com
05Pricing
Licensed to a name, not a headcount
No per-target fee: Iridia runs on your machine. Your key carries your name, studio brand or company and is printed on every report. USD, excluding tax.
Community
To learn and try it out
- Passive and active scans
- Bug bounty Markdown and SARIF
- Executive report with a watermark
Freelancer
For solo auditorsLicensed to you by name, unlimited clients
- Everything in Community
- Logged-in scans and two-account BOLA checks
- Stack patches and attack paths
- Client-ready report, no watermark
- Re-tests and fix certificate
Studio
One studio brand, the whole team
- Everything in Freelancer
- White-label: your studio’s name and logo
- Everyone at the studio can use it
- Client portfolio, scheduled monitoring, alerts
- Extra client-facing brand: $250 / year
Team
Your whole organization
- Everything in Studio
- Any number of people and CI runners
- GitHub Actions and GitLab CI templates
- SARIF gates and re-test exit codes
- Priority support
06FAQ
Questions
Does Iridia use AI?
No. Every decision is a deterministic rule you can read and test. The same site gives the same report, and nothing is sent to a model or a third-party API.
Where does client data go?
Nowhere. Scans run from your machine and results stay in local files. In the desktop app, test credentials reach the engine over an internal channel rather than the command line, and they never appear in reports.
How does the license work without a server?
Your key is signed and checked offline on your computer — no account, no phone-home. It names you, your studio brand or your organization, and that name is printed on every report.
Can it run in CI?
Yes, with a Team key. There is a GitHub Action and a GitLab template: scan staging after a deploy, re-test against a committed baseline, and fail the job only on new findings. Linux x86-64 runners today.
Does it replace a manual pentest?
No. It covers the repeatable part — the sweep, the write-up, the re-test, the watching — so a human spends time on business logic and chained attacks.
Which platforms are supported?
The desktop app runs on Windows. The ird command-line engine runs on Windows and Linux (x86-64), which is also what CI uses. macOS is planned.
Your next audit, delivered with proof.
Download Iridia, run your first audit in minutes, and upgrade when you need the report under your own name.
Desktop app for Windows · command line for Windows and Linux · macOS planned