Micro Pentest is for organisations that haven’t bought a plan yet. If you signed up through sales or already have a plan, you won’t see it. Start with a full Mjolnir run instead.
What you get
- One Micro Pentest per organisation. It is also one per repository and one per sign-up domain, so a second workspace on the same domain can’t run it again.
- A 24-hour window from the moment your organisation is created. After that the workspace is limited to choosing a plan.
- Code only. The run reads your repository; it doesn’t send traffic at a running application, and it doesn’t repeat on later commits.
Running it
Sign up, then Odin takes you to the setup screen. It has three steps and you can skip any of them.1
Answer three questions
What you’re building, what matters most right now, and your team size. Odin uses the answers to tailor your home view. They save as you pick them.
2
Choose where to start
Connect a repo runs the Micro Pentest. Add a domain maps your external attack surface instead. That is worth doing, but it isn’t the pentest, and it leaves your free run unspent.
3
Connect GitHub and pick a repository
Install the Odin GitHub App with read access, then choose a repository from the list. Odin scans its default branch, shown next to the name. Confirm that you’re authorised to test it, then select Start Micro Pentest.
The domain path
Adding a domain claims it for your organisation and starts asset discovery. The domain has to match your email address. Odin opens the attack surface map, which fills in over the next few minutes as recon finds subdomains, IPs and services.Watching the run
The run page follows five stages: cloning the repository, building the data-flow graph, identifying attack vectors, verifying exploitability, and writing findings. Counts appear beside each stage as the run reports them, including files indexed, input sources and dangerous sinks found, and how many attack categories are running. Leaving the page doesn’t stop anything. Return to it from your home dashboard.Results
When the run finishes you get a summary: verified findings, the count at the highest severity present, lines scanned, and the time it took to reach the first finding. Below that is the finding list, capped at three and limited to medium severity and above. Lower-severity issues are still produced but aren’t surfaced. Open Findings for the full write-up on each one: description, exploit path, and a remediation patch. While you’re on the trial the Findings page is scoped to this run and carries a Micro Pentest scope badge. A footer there counts the unverified candidate issues the run turned up but didn’t confirm. A run can also end in one of these states:- No high-confidence findings. The scan found nothing it could verify in your repository.
- Trial budget reached. The run hit its free budget before confirming anything.
- The scan didn’t finish. Something failed on our side. Select Retry Micro Pentest to run it again at no cost. You get two retries, and a retry never spends the trial a second time.
A Micro Pentest runs once. Continuous scanning, live verification against a running application, and scheduled assessments all need a plan. Micro runs themselves can’t be scheduled.