> ## Documentation Index
> Fetch the complete documentation index at: https://docs.breachlens.app/llms.txt
> Use this file to discover all available pages before exploring further.

# BreachLens

> Self-hosted application security that proves which findings are exploitable — every scanner class, correlated into attack paths, with auto-fix you review. Runs inside your own perimeter; bring your own AI model.

BreachLens is the application security platform you can run inside your own perimeter. It runs every major scanner class, proves which findings are actually exploitable, correlates them across tiers into proof-of-exploit attack chains, and generates auto-fix pull requests with your own model keys — all inside your own network, with disconnected deployment supported once you provision offline mirrors for the scanner rules and vulnerability data.

<CardGroup cols={2}>
  <Card title="Book a live demo" icon="play" href="mailto:sales@breachlens.app?subject=BreachLens%20live%20demo">
    See BreachLens run a real scan — findings, attack paths, and proof of exploit — walked through live. No install required.
  </Card>

  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Get BreachLens running on your own infrastructure with `docker compose` in under 10 minutes.
  </Card>
</CardGroup>

## What you get

<CardGroup cols={2}>
  <Card title="The whole scanner stack" icon="layer-group">
    SAST, SCA, secrets, IaC, container, DAST, and autonomous pentest — orchestrated as a single pipeline, no per-scanner integration work.
  </Card>

  <Card title="Multi-AI BYOA" icon="sparkles">
    Plug in your own Anthropic, OpenAI, Gemini, or self-hosted Ollama keys. BreachLens generates auto-fix pull requests with the provider you choose, per service.
  </Card>

  <Card title="Cross-tier attack paths" icon="route">
    A SAST finding in `payments-api` plus a container CVE plus a public DAST endpoint becomes one chain. Break one link, break the chain.
  </Card>

  <Card title="Proof-of-exploit video" icon="video">
    Browser-drivable exploits get a replayable video where available — PR-grade evidence, not just a CVE number.
  </Card>

  <Card title="Function-level reachability" icon="crosshairs">
    For supported ecosystems, SCA findings are tagged with whether the vulnerable function is reachable from your code (coverage varies by language). Stops you patching CVE-2024-X in a transitive dep no one calls.
  </Card>

  <Card title="Air-gap deployable" icon="shield-halved">
    Your code, findings, and AI inference never leave your network, and no telemetry phones home. For fully disconnected networks, provision offline mirrors for the scanner rules and vulnerability data (customer-pulls, vendor-never-pushes). Built for federal, financial, healthcare, defense.
  </Card>
</CardGroup>

## Who it's for

BreachLens is built for **AppSec engineers**, **DevSecOps leads**, **CISOs**, and **security architects** at mid-market and enterprise organizations who need:

* A unified platform that consolidates SCA, container, IaC, DAST, cloud-posture and pentest into one pipeline (built on hardened open-source engines)
* Self-hosted deployment with no vendor data exfiltration
* Auto-fix automation that doesn't lock them into one AI vendor
* Compliance reporting (SOC 2, PCI DSS, and the OWASP Top 10 / API / LLM / CI-CD catalogs)
* Cross-tier evidence for the actual exploits that matter

<Note>
  Looking for a license to deploy in production? Contact us at [sales@breachlens.app](mailto:sales@breachlens.app?subject=BreachLens%20license%20request) — we'll send the EULA and license JWT within 24 hours.
</Note>