HKrChroma LabsRequest a pilot

Attackers exploit in a day.Your pentest runs once a year.

HKr puts agents on your attack surface and inside every pull request, and turns each finding into a fix your team can merge today.

Request a pilotSee a live run

Anything found between pentests stays open until the next one.

Median time from disclosure to exploit, drawn to scale.
20211 year
20261 day

At this scale a day is a hairline. A minute is thinner than that.

Sources: Epoch.ai via a16z, 2026 (1 day); 2018–2024 trend (1 year); 2027 projected (1 min); zerodayclock.com (86.7%).

Defense has to run at attacker speed.

Outside in and inside out: agents attack what you've shipped and review what you're about to ship. Every finding comes back as a pull request — or merge request. Your team merges.

Exploitable paths found before attackers find them.

Agents attack your live surface the way an attacker would. Proof kept. The fix arrives as a pull request.

  1. 1

    Prove your domain

    Verify ownership. Nothing to install.

  2. 2

    Agents attack it

    Every host on your surface, tested the way an attacker would. Proof kept.

  3. 3

    A pull request fixes it

    Ready for your team to review and merge.

  4. 4

    Every push, again

    Each change is re-tested. Back to step 1.

app.hkr.chrom.ar/run/8f21c42:47
09:42:01recon47 hosts enumerated
09:42:04reconapi · 443, 8443 open
09:42:15exploittesting IDOR on /v2/accounts/{id}
09:42:18exploit/v2/accounts/1042 → 200 · other user’s data
09:42:18findingCRITICAL · authenticated IDOR
09:42:23exploitJWT accepted with foreign audience
09:42:31evidenceproof recorded
09:42:47fixpull request opened · checks pass
09:42:00 
CriticalAuthenticated IDOR
HighJWT audience not verified
chrom-ar/payments-apifix/idor-accounts-guard+38 −4, mergeable
−return this.accounts.find(id);
+if (req.user.id !== id) throw new Forbidden();
+await this.authz.assertOwner(req.user, id);

Vulnerabilities caught before merge.

AI writes code at machine speed and insecure patterns ship on a green build. Every pull request is reviewed inline, before it merges. Your team keeps the merge decision.

  1. 1

    Pull or merge request opened

    Webhook in. Nothing to install.

  2. 2

    Inline comments

    Exact lines. New, inherited, resolved.

  3. 3

    “@hkr fix H-1”

    Rewrites, builds, opens a fix PR.

  4. 4

    Your team decides

    HKr never merges.

github.com/acme/orders-api/pull/2814open, +24 −0
Openfeat(orders): add lookup by customer ID#2814 · 2 commits · m.acosta wants to merge into main
src/main/java/com/acme/orders/OrderRepository.java+5 −082% AI-generated
  1. +public Order findByCustomerId(String customerId) {
  2. + return jdbc.queryForObject(
  3. + "SELECT * FROM orders WHERE customer_id = '" + customerId + "'",
  4. + orderMapper);
  5. +}
hkr-botreview on OrderRepository.java:19 · 38 seconds ago
High · H-1CWE-89 · SQL injection

New: findByCustomerId concatenates the customer-ID path parameter directly into the SQL. A request with ' OR '1'='1 in the path returns every order in the table: full enumeration, no authentication bypass needed. Suggestion: parameterize the filter with ? and a bound argument, matching the JdbcTemplate shape used elsewhere in this file.

Never merges
HKr proposes pull requests. Your team decides.
Minimum access
Only domains you prove are yours. Read-only repository scopes on GitHub, GitLab or Bitbucket. No production access.
Ephemeral runners
Destroyed after every run.
Your evidence
Every step recorded and kept in your account. Nothing leaves your environment.

The next exploit won't waitfor your next pentest.

Request a pilot