Free pentest. Pay only to unlock the report.
8 out of 10 startups have critical or high vulnerabilities exposed. We run a real authorized pentest against your web app at no cost and share how many critical, high, and medium issues we found. If you want the full details and fix instructions, unlock the report at the price set upfront in the authorization you sign. Price depends on your company size and industry. No surprise invoice.
Four steps. No procurement. No quarterly waits.
From the moment you join the waitlist to a written report in your inbox: roughly 7 to 14 days, end to end.
Join the waitlist
Name, work email, company URL, role. Takes 30 seconds.
Scope on a call
Confirm domain ownership, agree on scope, pick a 14-day window.
Sign the authorization
One page, DocuSign, Delaware-governed. Your unlock price is in it, set before we run.
Free counts. Optional unlock.
You see the severity counts for free. Unlock the report only if you want the details.
Free pentest. Paid report. Price set upfront.
The pentest is free. You always see how many critical, high, and medium issues we found. The full report, with what they are, where they are, and how to fix them, is paid. Your unlock price depends on your company size and industry, and is written into the authorization before we run anything. No surprise invoice, no renegotiation after we find vulnerabilities.
Severity counts
Total findings by severity. Always free. No catch, no upsell pressure.
Full report
- Vulnerability name & location
- Proof of concept + reproduction steps
- CVSS 4.0 score and CWE tagging
- Concrete fix instructions
- SOC 2 CC7.x evidence
Price depends on your company size and industry. Written into your authorization before we run anything.
When you unlock, a report your team can act on.
Not a 60-page consulting deliverable. Every row is scored, reproducible, and ships with a concrete fix. Audit-ready for SOC 2 CC7.x. Routes into Linear, Jira, or GitHub Issues without rewriting. If you want to check the full report, download a sample (PDF).
The bio field on /api/users/me persists user-supplied HTML without sanitisation. The markup renders raw on the public profile route at /u/:handle.
Any authenticated attacker can plant a payload in their own bio that fires on every visit, including unauthenticated visitors. With a shareable profile URL, this enables one-click session theft and account takeover.
We can be your SOC 2 pentest auditor.
Auditors don't accept “we ran a scanner” as evidence. The Kosuke deliverable drops straight into your SOC 2 Type II workpapers. Mapped to CC4.1, CC7.1, and CC7.4, scored under CVSS 4.0, framework-anchored to OWASP WSTG v4.2, and re-tested by us after you patch. Want to see the exact format your auditor will receive? Download the SOC 2 sample report (PDF).
Mapped to SOC 2 controls
Every finding tagged with the control it supports: CC4.1, CC7.1, CC7.4. Your auditor reads across the row, not back and forth.
OWASP WSTG v4.2, anchored
Per-category coverage matrix plus a per-test-case appendix listing the pipeline step that satisfied each WSTG ID.
Re-tested by us, not by you
We re-run the original PoC after you patch. The verified-date is written only when the exploit no longer reproduces.
Signed, hashed, retained
Unique report ID, Statement of Independence, SHA-256 hash, and a public verify URL. Raw evidence retained for 12 months, available to your auditor on written request.
You own the asset. You authorize the testing.
Same legal posture every pentest firm uses, from Bishop Fox to Cobalt. Well-precedented for 20+ years. We run as your authorized agent, against assets you control, under a written agreement that names exactly what is in scope.
Domain ownership, verified first
Before any active testing, you publish a DNS TXT record or a /.well-known token. We do not run the agent against domains you cannot prove control of.
Rate-limited and non-destructive
≤10 requests per second per host unless you authorize higher in writing. No mass account creation, no payment-flow exploitation, no data deletion, no DoS.
Encrypted, then deleted
PoCs use synthetic payloads wherever possible. Engagement artifacts encrypted at rest (AES-256) and deleted within 30 days of report delivery.
Request a free pentest.
We will reply within 24h with a proposal that includes your exact unlock price for the full report. Then a 15-minute scoping call. No procurement. No NDA before the call. No pricing pressure.
- Pentest is free. Severity counts are free. Report is paid. Price set upfront in the authorization.
- Domain ownership verification before any active testing.
- Report ready for SOC 2 CC7.x evidence.
Common Questions
How long does the engagement take?
What if you don't find anything?
What if you do find something?
How is the unlock price set?
Is this actually legal?
Do you store our data?
Strike. The startup security posture directory.
A public, searchable, neutral directory of startup security posture. Browse by industry, country, stage, investor, or tech stack.