PurpleTeam

What PurpleTeam is

PurpleTeam is a command-line interface and service for dynamic application security testing of web applications and APIs. The maker describes it as language agnostic. Listed targets include authenticated applications, single-page applications, TLS/SSL deployments, server configurations, server-side HTML, GraphQL APIs, and REST APIs. Its API formats include OpenAPI, SOAP, and GraphQL.

The CLI can run without a visible interface in build pipelines. Teams can choose to run scans on commits, pushes, nightly, or at another time. Results provide defect locations, remediation guidance, test reproduction instructions, and tips for finding similar issues. Users can adjust tester attack strengths and alert thresholds, including settings for existing defects that should not fail a test run. The maker says the CLI process runs anywhere and needs no specific integrations.

The free Community plan is hosted locally and includes unlimited scans and targets, with 12 concurrent test sessions. Standard and Pro are cloud-hosted: annual billing is $85 a month for Standard and $185 a month for Pro; monthly billing is also shown at $110 USD per month and $240 USD per month, respectively. A 14-day trial is available. Documentation describes local OWASP and cloud BinaryMist environments, with cloud onboarding requiring contact with the maker.

Who it suits

PurpleTeam suits software engineering and development teams that want dynamic security testing for web applications or APIs, including authenticated targets. Its pipeline mode and adjustable test and alert settings may suit teams fitting scans into commit, push, or nightly workflows.

Limits

Community allows 12 concurrent test sessions, with unlimited scans and targets. Standard is limited to 360 scan minutes per day and four concurrent sessions; Pro is limited to 480 scan minutes per day and eight concurrent sessions. The trial lasts 14 days.

Getting started

1. Open https://purpleteam-labs.com/ to review the product and plans.
2. Choose the Community plan for a locally hosted environment, or consider the 14-day trial.
3. For cloud hosting, contact the maker to complete onboarding.
4. Run the CLI in a build pipeline or at a chosen time, such as on commit, on push, or nightly.
5. Adjust tester attack strength and alert thresholds for the test run.

Verdict

Choose PurpleTeam if you need language-agnostic dynamic testing for web applications and APIs, with pipeline execution and guidance for addressing findings. The free Community plan runs locally; look at Standard or Pro for cloud hosting, while accounting for their daily scan-minute and concurrent-session limits.