StackHawk

What is StackHawk?

StackHawk is a developer-first dynamic application security testing (DAST) platform that tests running applications and APIs for exploitable vulnerabilities. The vendor now positions it as a security platform for AI coding agents that finds, fixes and verifies issues before a pull request opens.

Key features of StackHawk

• Find: runtime tests that report only exploitable issues.
• Fix: the coding agent edits the codebase to remediate findings.
• Verify: a rescan confirms the vulnerabilities are gone.
• HawkScan skill: runs scans and handles remediation and verification.
• StackHawk API skill: lets an agent configure scans and manage findings.
• Security attestation: a record that the scanned changes passed.

How StackHawk works

StackHawk boots your application, runs security tests against it, and reports exploitable findings. A coding agent such as Claude Code or Cursor receives the findings, changes the code and triggers a rescan. CI gets a clean signal once findings are fixed. The vendor provides repo-based skills so every developer follows the same workflow.

Who uses StackHawk?

StackHawk is for engineering teams building with AI coding agents and for AppSec teams that need runtime testing in CI/CD. The vendor's repo-based skills aim to give each developer the same security workflow.

StackHawk pricing

StackHawk lists two plans. Wingman is $10 per user per month, billed monthly, with unlimited apps and 50 scans per user per month, standard support and a 14-day free trial with no credit card. Scale is quoted by the vendor and includes unlimited apps and agentic scans, attack surface discovery, sensitive data detection, reporting, teams, roles and SSO, with a separate 14-day trial through sales.

StackHawk integrations

StackHawk names Claude Code, Cursor, Codex, Antigravity and GitHub Copilot.

StackHawk alternatives

Snyk is a broader developer security platform that includes static analysis and dependency scanning alongside testing. Semgrep is a static analysis tool that reads code rather than testing a running app. Contrast Security uses instrumentation for runtime application security. StackHawk differs by running dynamic tests against a live app and feeding the results to coding agents.