Find the vulnerabilities that come from your application's own rules: IDOR, broken authorization flows, race conditions, mass-assignment privilege escalation. No static signature can express these classes. Keygraph surfaces them from source; the whitebox pentest proves them with a working exploit.
Traditional SAST tests for patterns. We test for behavior. An LLM reads your codebase end-to-end, derives your application's security-critical invariants, then walks the code looking for where they break. We don't report what might be vulnerable. We prove what is.
Six classes of business logic vulnerabilities that signature-based tools cannot detect, because each one depends on context only your codebase carries.
Invalid state transitions or missing state checks.
Flawed permission models, privilege escalation paths.
Timing-dependent logic errors.
Business rule bypasses through unexpected input sequences.
Out-of-order operations the application permits but shouldn't.
Broken assumptions about data consistency.
From invariant discovery to working exploit, business-logic testing is the logic-flaw arm of the whitebox pentest: every finding is validated and reproducible. No Exploit, No Report. Discovery runs as the final phase of the SAST pipeline, and results merge into the same SARIF stream.
Reads your code end-to-end and defines business invariants: security-critical rules unique to your application, such as multi-tenant data isolation, checkout totals that must never go negative, role-based access boundaries, rate-limiting enforcement, and state machine transitions that shouldn't be skippable.
Systematically walks the codebase looking for places where each invariant breaks. Missing authorization checks on admin endpoints, tenant ID filters that can be bypassed via parameter tampering, payment flows where amount validation happens client-side only.
Each candidate violation is confirmed against the actual code to rule out false positives. Only confirmed violations advance to the exploit phase.
Every confirmed finding gets a full proof-of-concept exploit with step-by-step reproduction instructions: the exact HTTP requests, parameter values, and sequencing needed to demonstrate the vulnerability in a running environment.
Because Business Logic Testing runs inside the SAST pipeline and emits findings in standard SARIF, results merge with other SAST findings and flow through the canonical findings deduplication system. Each finding lands as an identified, validated, and recorded vulnerability with its reproduction steps attached.
Business invariants are not generic patterns. They describe what your application is supposed to do, the rules that hold for your data, your tenants, your workflows.
A banking app requires strict multi-tenant isolation. Account balances, transaction logs, and user records must never leak across tenants.
A social media app intentionally exposes certain information platform-wide, but has invariants about what should be private to a user, visible only to followers, or fully public.
Same vulnerability class, opposite correct behavior. Pattern-based scanners cannot tell the difference. Keygraph derives your invariants from source, then the whitebox pentest exploits the places they break.
Schedule a technical demo and watch Business Logic Testing run against your staging environment as part of the whitebox pentest: it derives your application's invariants, confirms violations, and builds a proof-of-concept exploit for every finding.