Question 1

What languages does winfunc support?

Accepted Answer

winfunc is not tied to a single rule set. It combines parsers, language servers, and model-assisted analysis, and its public findings already span C, C++, Go, Rust, Python, TypeScript, PHP, Ruby, and Lua codebases. Share a representative repository and we will confirm depth for your stack before an audit.

Question 2

How does winfunc keep false positives out of the report?

Accepted Answer

Every candidate is traced from source to sink and checked against the controls on that path. Where testing is in scope, winfunc reproduces the exploit in an isolated environment and attaches the evidence. Anything it could not establish is labeled as inference, so your team reviews a short list of supported findings instead of a queue of alerts.

Question 3

Can winfunc find business-logic vulnerabilities?

Accepted Answer

Yes. winfunc investigates roles, permissions, tenant boundaries, transactions, and state changes, which is where many of its public findings live: cross-tenant account takeovers, authorization bypasses, and payment logic flaws that pattern-based scanners do not model.

Question 4

How is this different from a penetration test?

Accepted Answer

They work well together. A pentest brings human judgment to an agreed, point-in-time scope. winfunc adds full codebase context and keeps investigating as the code changes, on every pull request and on a schedule, so coverage does not end when the engagement does.

Question 5

Where does our source code go?

Accepted Answer

Authorize the repositories and application context you want reviewed. Analysis can send source context to configured model providers. Working copies, caches, findings, resume data, and backups have different lifecycles; agree retention and provider restrictions for your deployment. Customer-controlled hosting and model credentials are enterprise options by agreement.

Question 6

Is winfunc ready for enterprise security review?

Accepted Answer

Start with the procurement pack and current Trust Center materials. Review repository permissions, data flows, retention, model-provider terms, and administrative events. Enterprise identity, hosting, isolation, and named-support options are scoped by agreement; request assurance reports and confirm the deployment-specific controls before granting access.

Question 7

What is an AI security platform?

Accepted Answer

An AI security platform uses AI agents to do the work of a security engineer: read the codebase, find vulnerabilities, prove they are exploitable, and fix them. winfunc covers application code (SAST), dependencies (SCA), infrastructure as code, secrets, and containers, and extends into threat modeling, cloud security, and AI penetration testing.

Question 8

Can AI do penetration testing?

Accepted Answer

Yes, when it is held to an evidence bar. winfunc's agents read the source code, map the attack surface, chain weaknesses, and reproduce exploits in isolated environments before reporting them. Human testers stay valuable for judgment and scope; winfunc gives them full code context and keeps testing between engagements.

Question 9

How is winfunc different from traditional SAST tools?

Accepted Answer

Rule-based SAST matches code patterns and leaves your team to triage the noise. winfunc follows attacker-controlled input through the application to the operation it reaches, proves exploitability, and ships the fix as a pull request, so each finding arrives as a decision instead of an alert.

Security that keeps up with engineering.