drop your url. get a pentest report you can send to your customer.
A customer, partner or auditor asked if your app has been tested. We test it the way an attacker would and send you a report that answers the question.
Early access. Leave your email and we will tell you when it is ready.
how it works
- Drop the URL of your live app and your email.
- We look for what attackers look for first: keys shipped in the page, databases anyone can read, admin routes that answer without a login, forms that trust the user, password resets that never expire.
- You get a report with each finding, how serious it is, how to reproduce it and what to change. Written so you can forward it.
what the report looks like (example findings)
Example finding
Critical Database service key shipped in the browser bundleAnyone who opens dev tools can read and write every table. Rotate the key, move server-side calls behind an API, turn on row-level security.
Example finding
High Admin API answers without a session/api/admin/users returns every user with no auth header. Add the session check the other routes already use.
Example finding
Medium Password reset links never expireA reset link from a month-old email still works. Expire tokens after 30 minutes and on use.
questions
- Who is this for?
- Founders and small teams who have shipped a web app and have been asked whether it has been security tested. You do not need to know what any of the findings mean; the report explains each one.
- What do you need from me?
- A URL and an email. If you want a deeper review of the code itself, you will be able to connect a repository.
- What does it cost?
- Joining early access costs nothing. We will show the price of a test before you pay for anything.
- Will you break anything?
- We only read. No load, no destructive requests, nothing deleted.