One finding, walked from a working exploit to a green retest and a reviewed pull request. The remediation loop is a paid Pro capability; finding and proving the vulnerability is open source. This is an illustration of the loop, not a staged product video.
Illustrative animation. The verified evidence for every finding lives in the published dossier.
The autonomous pentest already demonstrated impact, e.g. an admin account reachable with a weak password. The finding carries the exact request and raw response, not a score.
The remediation agent maps the finding to the real source file and generates a minimal diff, the actual fix, not a suppression or a scanner rule tweak.
The branch type-checks, then the original exploit is replayed against a live instance. The fix only counts when the exploit now fails and the finding is confirmed closed.
A pull request is opened, disclosed as AI-generated, and left for a human to review and merge. Darkmoon never auto-merges its own fix.
The exploit runs against the live target and succeeds, the finding is graded EXPLOITED with the exact payload and raw output captured as proof.
The same exploit is replayed against the patched branch and now fails. Only then does the finding count toward the 42 of 57 demonstrated end-to-end.
The full numbers, limits and per-PR verdicts are on the remediation benchmark page.
The offensive engine is open source; the remediation loop is a Pro capability that opens reviewed PRs, never merges them.