Free pentest. Pay only to unlock the report.
8 out of 10 startups have critical or high vulnerabilities exposed. We run a real authorized pentest against your web app at no cost and share how many critical, high, and medium issues we found. If you want the full details and fix instructions, you can unlock the report. You see the counts for free and only pay if you choose to unlock the details. No surprise invoice.
State of the art. Not a claim, a benchmark.
On xbow, the public web-CTF suite, Kosuke Pentest tops the leaderboard, ahead of every frontier lab's own reported score. Each bar is the share of buildable challenges solved; third-party numbers are self-reported on their own runs. Figures stream live from our benchmark harness.
Teams who sleep at night
Four steps. No procurement. No quarterly waits.
From the moment you request a pentest to a written report in your inbox: roughly 7 to 14 days, end to end.
Request a pentest
Work email and company URL. Takes 30 seconds.
Accept the terms
Tick the Terms of Service and submit your domain. Scope is set, no call needed.
Confirm you control this inbox and authorize the scan.
Confirm your email
Click the link we email you. It authorizes the scan. No DNS record, no call.
Free counts. Optional unlock.
You see the severity counts for free. Unlock the report only if you want the details.
Free pentest. Paid report.
The pentest is free. You always see how many critical, high, and medium issues we found. The full report, with what they are, where they are, and how to fix them, is paid. You see the counts for free and only pay if you want the details, at the prices published below. No surprise invoice, no renegotiation after we find vulnerabilities.
Severity counts
Total findings by severity, plus an attestation letter and embeddable security badge. Always free. No catch, no upsell pressure.
Full report
- Vulnerability name & location
- Proof of concept + reproduction steps
- CVSS 4.0 score and CWE tagging
- Concrete fix instructions
- SOC 2 CC7.x evidence
You see the severity counts for free. Unlock the vulnerabilities you want, priced per severity and capped per company size. Full pricing is published below.
Per-vulnerability pricing, capped
Prices in EUR| Company size | Critical | High | Medium | You never pay more than |
|---|---|---|---|---|
Small(up to €2M revenue) | €600 | €150 | €50 | €1,000 |
Medium(up to €10M revenue) | €1,800 | €400 | €150 | €3,000 |
Large(over €10M revenue) | €3,000 | €700 | €250 | €5,000 |
The pentest and the severity counts are always free. You only pay to unlock the vulnerabilities you choose to see, priced by severity. The cap is the most you can pay per engagement. Every detail beyond it is free. Low and informational findings are always free. Custom pricing is available for specific engagements.
When you unlock, a report your team can act on.
Not a 60-page consulting deliverable. Every row is scored, reproducible, and ships with a concrete fix. Audit-ready for SOC 2 CC7.x. Routes into Linear, Jira, or GitHub Issues without rewriting. If you want to check the full report, download a sample (PDF).
The bio field on /api/users/me persists user-supplied HTML without sanitisation. The markup renders raw on the public profile route at /u/:handle.
Any authenticated attacker can plant a payload in their own bio that fires on every visit, including unauthenticated visitors. With a shareable profile URL, this enables one-click session theft and account takeover.
We can be your SOC 2 pentest auditor.
Auditors don't accept “we ran a scanner” as evidence. The Kosuke deliverable drops straight into your SOC 2 Type II workpapers. Mapped to CC4.1, CC7.1, and CC7.4, scored under CVSS 4.0, framework-anchored to OWASP WSTG v4.2, and re-tested by us after you patch. Want to see the exact format your auditor will receive? Download the SOC 2 sample report (PDF).
Mapped to SOC 2 controls
Every finding tagged with the control it supports: CC4.1, CC7.1, CC7.4. Your auditor reads across the row, not back and forth.
OWASP WSTG v4.2, anchored
Per-category coverage matrix plus a per-test-case appendix listing the pipeline step that satisfied each WSTG ID.
Re-tested by us, not by you
We re-run the original PoC after you patch. The verified-date is written only when the exploit no longer reproduces.
Signed, hashed, retained
Unique report ID, Statement of Independence, SHA-256 hash, and a public verify URL. Raw evidence retained for 12 months, available to your auditor on written request.
Tell your customers you have been assessed.
Every engagement ships with a formal attestation letter and an embeddable security badge, both at no cost. The letter confirms scope, methodology, and severity counts without disclosing finding details. The badge is hosted by Kosuke and verified against our records.
A formal PDF for your customers, partners, and auditors. Confirms the assessment was performed. Severity counts only.
Embed on your website. Hosted by Kosuke and verified against our records. Unknown IDs return nothing.
You own the asset. You authorize the testing.
Same legal posture every pentest firm uses, from Bishop Fox to Cobalt. Well-precedented for 20+ years. We run as your authorized agent, against assets you control, under Terms you accept that name exactly what is in scope.
Email-verified authorization
Before any active testing, you accept Terms warranting you own or are authorized to test the target, and confirm control of your inbox by clicking the link we email you. We do not run the agent until that authorization is on record.
Rate-limited and non-destructive
≤10 requests per second per host unless you authorize higher in writing. No mass account creation, no payment-flow exploitation, no data deletion, no DoS.
Encrypted, then deleted
PoCs use synthetic payloads wherever possible. Engagement artifacts encrypted at rest (AES-256) and deleted within 30 days of report delivery.
Request a free pentest.
Accept the Terms and confirm your email, and we start. We reply within 24h with your results, and if you want the details you unlock them at the published price. No scoping call. No procurement. No NDA. No pricing pressure.
- Pentest is free. Severity counts are free. Full report is paid, only if you want the details.
- Email verification before any active testing.
- Report ready for SOC 2 CC7.x evidence.
We can also map what the internet already knows about your team: harvested employee emails, historical breach correlation, active session leaks. Standalone engagement, priced separately, not part of the pentest report.
Our experts validate the AI output. Before anything ships.
The agent runs the engagement and surfaces candidate findings. Our pentesting team reviews each one, reproduces the exploit, and signs off before the report reaches your inbox.
Reviewed by our pentesting team
- False positives die in triage
- Every PoC reproduced by hand
- Senior pentester sign-off before delivery
Common Questions
How long does the engagement take?
What if you don't find anything?
What if you do find something?
How is the unlock price set?
Is this actually legal?
Do you store our data?
Strike. The startup security posture directory.
A public, searchable, neutral directory of startup security posture. Browse by industry, country, stage, investor, or tech stack.