Planck Operator

Operator, by Planck Proof, is an autonomous API penetration testing service. It takes an API base URL, an OpenAPI or Swagger specification, and credentials for one or more user roles. Operator enumerates documented operations in scope and tests them for broken object-level and function-level authorization (BOLA and BFLA), broken authentication, injection, and mass assignment. When multiple roles or tenant identities are supplied, it can replay requests across those identities to test authorization boundaries.

Proof for every finding

Operator reports only findings it reproduces against the target. Each finding includes the relevant request and response, a CVSS v3.1 vector, reproduction steps, and remediation guidance. Depending on the engagement, findings can also include a runnable proof of concept, such as a curl command or script, so engineering teams can validate the issue and later confirm a fix.

Coverage

Testing is mapped to the OWASP API Security Top 10 and supports REST, GraphQL, and gRPC APIs. The vendor also describes coverage for APIs, tools, and retrieval systems used by AI agents and LLM applications. Operator tests only the documented operations selected for an engagement; it does not perform unrestricted endpoint discovery or blind fuzzing.

Control and safety

Operator allows users to steer, narrow, pause, or stop a run. Scope is enforced against a verified domain and defined API base URL. Read-only testing is the default; state-changing requests require explicit authorization, and destructive actions can be restricted. The vendor supports testing in development, staging, and production environments, subject to the agreed rules of engagement.

Continuous testing and integrations

Operator is available for annual assessments or recurring scans. Recurring engagements can run as APIs change and can route findings to connected tools through integrations and webhooks. The vendor lists integrations with DefectDojo, Slack, GitHub, GitLab, and webhook endpoints.

Reporting

Reports include scope, methodology, severity, per-finding evidence, and reproduction guidance. The testing methodology references standards and frameworks including the OWASP API Security Top 10, OWASP ASVS, PTES, NIST SP 800-115, and CVSS v3.1. Planck Proof also offers senior manual API testing and red-team engagements for business-logic and creative attack scenarios that require human testing depth.

Pricing and availability

Operator is delivered as a managed service. A free Demo maps an API’s vulnerability surface through passive, read-only exploration; it does not conduct active exploitation. Annual Assessment, Pro, and Enterprise engagements are quoted based on factors including API endpoint volume, scan cadence, and deployment requirements. Development, staging, and production environments are priced consistently. Private VPC and on-premises deployment options are available for Enterprise customers.

Intended users

Operator is intended for application-security teams, platform and backend engineers, and security leaders responsible for APIs in SaaS, fintech, healthcare, and AI-focused organizations.