Pulseguard
Under Attack?Security Lab
Hands-on testing, built in.
Automated rules find the issues that look the same on every site. The ones specific to your business logic need someone to look. Security Lab is that surface: intercept a request, change one field, send it again, and read exactly what came back.
- Tools in the workbench
- 6
- Installs or licences
- 0
- Domains only
- Verified
- Every session action
- Logged
Intercept, edit, resend, read.
The same loop a manual tester runs a hundred times a day, without a desktop proxy, a CA certificate to install, or a separate licence to renew.
authorization: Bearer eyJhbGciOiJIUzI1NiIs…
content-type: application/json
x-account-id: 4421
x-request-id: req_8f21ac
cache-control: no-store
Scanners don't understand your business
No rule set knows that account 4421 shouldn't be able to read account 4422. Finding that takes a person, a request, and a way to change one value.
Logic flaws need a human
Broken access control, tenant isolation gaps, and workflow bypasses are invisible to signature matching. They're found by someone changing an identifier and noticing the response was accepted.
One change at a time
The repeater keeps the original request intact so you can vary a single field and compare responses honestly, instead of rebuilding a curl command from memory each attempt.
Nothing hidden by the client
Requests are read as they go out, so a value the interface won't let you change is still visible, and still testable, before it reaches the server.
In the same place as the findings
The endpoints came from your discovery data and the evidence goes back to the same finding model. Manual work stays part of the record instead of living in someone's local tooling.
No local setup
It runs in the browser. There's no proxy to configure, no root certificate to trust on your machine, and nothing to reinstall when a laptop gets replaced.
Bounded to what you own
The workbench is scoped to verified domains on your projects. It isn't a general-purpose proxy pointed at whatever you type.
Six tools, one session
Each shares the same captured traffic, so a request you spot in the proxy is one click from the repeater and its decoded payload.
Intercepting proxy
Watch requests as they pass, with method, path, status, and timing on every row. It is the starting point for everything else.
Repeater
Resend any captured request with edited headers or body, and diff the response against the original.
Decoder
Base64, URL encoding, hex, and JWT payloads decoded inline, with claim-level warnings like a token that never expires.
Request analyzer
Infers parameters, auth scheme, and schema from a request, and flags fields that look sensitive or undocumented.
Traffic history
Everything the session has seen, timestamped and searchable, so a response you noticed ten minutes ago is still there.
Extensions
Focused probes (JWT inspection, GraphQL introspection, rate-limit measurement, header fuzzing) that reuse the same session.
A typical session
From noticing something odd in the proxy to a finding with evidence attached, without leaving the browser.
- 1
Pick a verified target
Sessions are scoped to a domain you've already verified on a project. That verification is what separates testing your own surface from pointing a proxy at someone else's.
- 2
Capture the request
Traffic passing through the proxy is listed with its method, path, status, and timing. Anything interesting moves straight into the repeater with headers and body intact.
- 3
Change one thing
Edit a single parameter, header, or identifier and resend. Keeping the rest of the request identical is what makes the difference in the response mean something.
- 4
Decode what came back
Encoded payloads, JWT claims, and inferred schema are readable in place, so you're not pasting tokens into an unknown website to find out what's inside them.
- 5
Keep the proof
A confirmed issue is recorded as a finding with the request and response as evidence, using the same immutable, redacted evidence model the automated scanner writes to.
Security Lab, answered.
It's in the browser, scoped to domains you've verified, and wired into the same findings and evidence model as the rest of PulseGuard. There's no CA certificate to install locally and no separate licence, but it also isn't trying to be a full replacement for a specialist desktop tool on an unbounded target.
Some bugs only turn up by hand.
Verify a domain and the workbench is available on it. No install, no licence.