What it does
StackHawk currently positions its product as an AI coding-agent security platform. Its runtime testing workflow scans a running web application, surfaces exploitable findings, and can let the coding agent remediate issues and rescan to verify the change before a pull request is opened. The documentation also exposes HawkScan, authenticated-scanning, API-configuration, and CI/CD guides for teams that need a more deliberate security-test workflow.
Put a security check inside the coding loop
For a feature branch, connect StackHawk to a supported coding agent and have the agent start the application it is changing. StackHawk's current product page describes running security tests against that live app, identifying exploitable findings, making a code fix in the same session, and rescanning to confirm the issue is gone before a pull request. This is an illustrative workflow based on the vendor's documented description; no application or agent was run for this listing.
Teams that need more control can use the HawkScan documentation and its guides for authentication, scan optimization, API formats, and CI/CD integrations. The workflow is dynamic application security testing, so it depends on a running target and does not replace unit tests or a static code analyzer.
The pricing page lists a paid per-user plan with a 14-day free trial and a separate StackHawk Scale plan sold through the sales team. The page displays a dollar amount for the per-user option but does not identify the currency or region in the text reviewed, so no exact amount is repeated here.
Strengths
- Runtime scans are described as testing the running application and focusing on exploitable findings rather than only source patterns.
- The product workflow can connect finding remediation and a verification rescan to a coding agent before a pull request.
- The official documentation links to guides for authenticated scanning, API configuration, scan results, and CI/CD integrations.
Watch out for
- The core HawkScan workflow is dynamic and requires a running application target; it is not a substitute for unit tests or static analysis.
Best for
- Development teams that want to run application-security checks before opening a pull request
- AppSec teams testing running web applications and API endpoints with dynamic scans
- Teams integrating security finding verification into coding-agent or CI workflows
Sources
- AI Coding Agent Security Platform | StackHawk, Inc. (Oct 26, 2026)
- Welcome to HawkDocs | StackHawk Documentation (Oct 26, 2026)
- Install & Run HawkScan | StackHawk Documentation (Oct 26, 2026)
- Pricing for StackHawk's AI Coding Agent Security Platform (Oct 26, 2026)