About
Systems fail. We don't.
BrokenApp builds the runtime app graph of your deployed web application — a structured representation of every route, form, endpoint, and auth flow as it actually behaves. We're building the inspection layer for the internet.
The problem
Most software ships broken.
You know it.
Every deployed web application has bugs. Security vulnerabilities, broken forms, exposed API keys, IDOR vulnerabilities that would make a bounty hunter's day. You know your app has problems — you just don't know where, or how bad.
Manual QA doesn't scale. Bug bounty programs are expensive. Static analysis reads code but misses runtime behavior. Automated testing catches what you write tests for, but misses everything else. The result: broken software ships to production every day.
Our approach
The app graph.
BrokenApp builds the runtime app graph — a structured representation of your running web application. Every route, form field, API endpoint, state transition, and auth flow, mapped automatically by crawling and testing the live app.
This graph is what makes everything else possible. AI agents read it via MCP to understand your app without source code. The scanner tests against it to find real vulnerabilities. Diff reports compare it over time to catch regressions.
Principles
How we operate.
Show, don’t guess.
Every finding comes with proof. Screenshots, request/response traces, reproduction steps. We don't report hunches.
Precision, not noise.
We don't flood you with warnings. Every issue has a severity rating, CWE mapping, and a clear path to resolution.
Built for builders.
CLI-native. CI/CD-ready. MCP-first. No dashboards you'll never check. Tools that fit into how you already work.
Uncomfortable honesty.
Your web app is broken. We'll tell you exactly how. No sugarcoating, no vanity metrics, no false sense of security.
Long-term vision
The app graph is the foundation.
The app graph is where everything starts. A structured, machine-readable representation of every running web application. Today it powers scanning and AI-assisted fixing. Tomorrow it powers continuous verification of every deployed application on the internet.
We see a future where every deployed application has a runtime spec, every bug is documented before a user encounters it, and every fix is verified automatically. The inspection layer. The trust layer. The kernel debugger of the internet.
The app graph — structured representation of the running app
The inspection layer — continuous runtime verification
The trust layer — proof that software works as intended