NEWBravos is availableCreate your account
Bugb Logo
Menu

What you buy here@asset <path>Declares a named asset: a component, a service or a data store.@asset in the GuardLink reference

Bravos is free to run. A licence takes it to every machine and pull request.

Bravos Free costs nothing and needs no account. A licence adds security scans (SAST) on your developers’ machines and on every pull request, your own Bravos server, the CI runner image, and GST invoices.

Buy a licence for one developer, or seats in bulk for your team or company. Prices are published on account.bugb.io.

Bravos licences

Bravos Free

Free. No account, no licence.

For one developer, on their own machine.

pipx install bravos
Install guide (opens in a new tab)
  • The whole pentest loop: auto, run, round and replay
  • A ledger of every run, reports and a local dashboard
  • The bravos ci build gate, which needs no server
  • Code graph, and an MCP surface for your coding agent

Bravos Solo

1 seat. Billed monthly or annually.

For one person who wants licensed scans and their own server.

Everything in Bravos Free, plus

  • Security scans (SAST) on your machine
  • Scans on every pull request
  • Your own Bravos server, self-hosted
  • A licence that renews itself every day
  • The CI runner image, from us
  • GST invoices

No repository limit. Cancel any time from your account.

See pricing and buyCreate your account

For teams and companies

Bravos Team

5 seats included, more on your contract. Priced on seats and term.

For a team sharing one server, one licence and one invoice.

Everything in Bravos Solo, plus

  • Invite and remove your people
  • Owners, admins and members
  • One licence for the whole team, with seats enforced on your server
  • Invoiced by us, by email

No repository limit.

Talk to sales

Bravos Enterprise

Seats and term set on your contract.

For procurement, your own terms, or an estate with no internet.

Everything in Bravos Team, plus

  • Seats and term agreed with you and printed on your licence
  • Air-gapped licence on a longer term
  • Your security review and a data processing agreement

No repository limit.

Talk to sales

Not sure what a seat is or how a licence renews? How licensing works (opens in a new tab)

From sign-in to a running server@flows <source> -> <target> [via <mechanism>]Documents data moving from one component to another, and what carries it.@flows in the GuardLink reference

How buying works

  1. Create your account

    Sign in at account.bugb.io with Google, GitHub or an email link. Your first sign-in creates the account. There is no password.

  2. Add your organisation and billing details

    Name your organisation and say who to invoice. Add your GSTIN before you pay and it appears on every invoice.

  3. Buy per developer, or seats in bulk

    One developer buys Bravos Solo by card from the account. A team or company agrees its seats and term with us, and we set the plan up on the account.

  4. We set it up with you

    Your licence is issued as soon as the plan is active. You create deployment keys for your server and CI, we hand over the server image and the CI runner image, and you invite your team.

Create your account

Services and assessments

When you want us to do the work: a threat model, a pentest, or the whole loop running in your CI/CD. We discuss your repositories, targets and access before proposing a scope.

  • Threat modeling as code

    Make security context part of your repository, not a document that drifts away from it.

    • GuardLink code annotations
    • Assets, threats and security assumptions
    • A threat model your team can review in Git
    Talk to sales

  • Pentesting as code

    Turn pentest hypotheses into executable tests you can keep, inspect and replay.

    • Cert-X-Gen pentest templates
    • Evidence-backed test outcomes
    • Replay stored probes after a fix
    Talk to sales

  • Continuous threat modeling and pentesting

    Connect the whole round in CI/CD with Bravos. Keep the model, pentests and evidence connected as your code changes.

    • Annotation, environment and authentication orchestration
    • Pentest execution and vulnerability ledgers
    • Evidence-backed annotation write-back
    • Re-testing and CI gates based on your policy
    Talk to sales

  • Whitebox AI-agentic pentesting

    Focus on an assessment with source-code context to guide hypotheses and testing.

    • Repository-informed threat hypotheses
    • Authenticated application testing
    • Findings with evidence and code context
    Talk to sales

  • Blackbox AI-agentic pentesting

    Focus on an assessment from the outside, without requiring source-code access.

    • Testing against an agreed target scope
    • Externally observable application behavior
    • Evidence and remediation guidance
    Talk to sales

Our open-source tools stay free on their own: GuardLink and Cert-X-Gen. Every engagement follows our responsible disclosure pledge.