Barb is Swarm Labs' security service: a real, authorised break-in of your application. Attackers only need one way in, and Barb finds it first, with every weakness proven and every fix verified before anyone else gets the chance.
Barb is not a scan. It reads your application from the inside, every route, access check and trust boundary, then tries to walk through the gaps the way a real attacker would. Scanners flag patterns; Barb proves impact, or gives you a clean bill of health you can trust.
What is Barb?
Barb pairs a whitebox code review with a non-destructive live test, so a flaw is confirmed both where it lives in the code and where it bites in the running application. Findings lead with the worst realistic exploit chain, showing how small issues combine into a real breach, rather than an alphabetised list of alerts. Each one ships with the exact file and line, a reproduction and a concrete fix.
The Engagement, Six Phases
- Scope and authorise: every target is authorised and scoped in writing first; third parties are never touched
- Whitebox and static analysis: the whole codebase is read and scanned, then every result is triaged by hand
- Authorised break-in: a non-destructive live pass covering access control, IDOR, authentication bypass, injection, SSRF and business logic
- Adversarial check: every High and Critical finding is independently challenged to be disproved, and only ships if the challenge fails
- Report: led by the worst exploit chain, then each finding with file and line, reproduction, impact, CVSS score and fix
- Retest: once fixes ship, they are retested live, because a fix that only works in the diff is not done
Scored, Not Guessed
Every issue is scored with CVSS 3.1 and the full vector is recorded, so the score is reproducible and reviewable. Every finding also carries an honest confidence label: source-confirmed, live-confirmed or needs sandbox.
What You Walk Away With
- A plan ranked by real-world risk, with the exact fix for each finding
- A living report that updates as fixes are retested
- A free retest of every fix
- A shareable status snapshot, online or as a PDF, to answer customers, auditors or your board with evidence
Barb is part of the Swarm Labs family alongside Scout and Apiary. Find out more at barb.swarmlabs.io.
Frequently asked questions
Is Barb an automated scan?
No. Barb is an authorised break-in: a whitebox review of your code paired with a non-destructive live test. Every finding is reproduced by hand, and High and Critical issues are independently challenged before they are reported.
How are findings scored?
With CVSS 3.1, recording the full vector so the score is reproducible, plus a confidence label: source-confirmed, live-confirmed or needs sandbox.
Will testing damage my application?
Testing is non-destructive, stays within the targets authorised in writing, never touches third parties and leaves nothing test-generated behind.
What happens after the report?
Once you ship fixes, Barb retests them live for free, and the report updates as each finding is closed.
