Free pentest. Pay only if we find something.
8 out of 10 startups have critical or high vulnerabilities exposed. We run a real authorized pentest against your web app. The price is set upfront in the authorization you sign. If we find nothing, you owe nothing. If we find something, you pay the amount you already agreed to. No surprise invoice.
Four steps. No procurement. No quarterly waits.
From the moment you join the waitlist to a written report in your inbox: roughly 7 to 14 days, end to end.
Join the waitlist
Name, work email, company URL, role. Takes 30 seconds.
Scope on a call
Confirm domain ownership, agree on scope, pick a 14-day window.
Sign the authorization
One page, DocuSign, Delaware-governed. Done in five minutes.
We run. You get the report.
Every finding scored, with PoC, CWE tag, and fix instructions.
A report your team can act on.
Not a 60-page consulting deliverable. Every row is scored, reproducible, and ships with a concrete fix. Audit-ready for SOC 2 CC7.x. Routes into Linear, Jira, or GitHub Issues without rewriting.
The bio field on /api/users/me persists user-supplied HTML without sanitisation. The markup renders raw on the public profile route at /u/:handle.
Any authenticated attacker can plant a payload in their own bio that fires on every visit, including unauthenticated visitors. With a shareable profile URL, this enables one-click session theft and account takeover.
You own the asset. You authorize the testing.
Same legal posture every pentest firm uses, from Bishop Fox to Cobalt. Well-precedented for 20+ years. We run as your authorized agent, against assets you control, under a written agreement that names exactly what is in scope.
Domain ownership, verified first
Before any active testing, you publish a DNS TXT record or a /.well-known token. We do not run the agent against domains you cannot prove control of.
Rate-limited and non-destructive
≤10 requests per second per host unless you authorize higher in writing. No mass account creation, no payment-flow exploitation, no data deletion, no DoS.
Encrypted, then deleted
PoCs use synthetic payloads wherever possible. Engagement artifacts encrypted at rest (AES-256) and deleted within 30 days of report delivery.
Request a free pentest.
We will reply within 24h to schedule the 15-minute scoping call. No procurement. No NDA before the call. No pricing pressure.
- Free if we find nothing. Price set in the authorization you sign.
- Domain ownership verification before any active testing.
- Report ready for SOC 2 CC7.x evidence.