Founding 10 — 10 left at $100

Find out what an attacker would find, for $100

A human breaks into your web app on purpose, then hands you two files: an HTML report that explains every hole, and a Markdown report your coding agent turns straight into fixes. Within 48 hours of payment.

No subscription. No account to create first — the email that pays becomes your account.

  • Manual, not a scanner
  • One domain, one payment
  • Delivered in 48h
  • Signed authorization first
security-report.html
Security auditapp.yourcompany.com
1Critical
2High
1Medium
critical
Any member can read another organization's invoicesGET /api/orgs/:id/invoices
high
Stripe webhook accepts unsigned payloadsPOST /api/webhooks/stripe
high
Password reset token stays valid after useauth/reset-password.ts
medium
No rate limit on the sign-in endpointPOST /api/auth/sign-in
The problem

Your scanner found 200 issues. An attacker needs one.

Automated tools are good at spotting missing headers and outdated packages. They have never once found the endpoint that returns another customer's data, because that bug only exists in your business logic — and nobody wrote a signature for your business.

Scanners test the framework

They know what WordPress looks like. They do not know that your invoice route trusts an id from the URL.

Agencies quote 10k and 3 weeks

A scoping call, an SOW, a kick-off. By the time it starts you have shipped forty commits.

So nothing gets tested

The app goes to production with real customer data and the honest security posture of hope.

What you get

Two reports, because two different readers have to act on them

A PDF nobody opens twice is not a security audit. You get one file to understand the problem and one file to fix it.

The HTML report, for you

Every finding written for a human: what it is, how it was reached, what an attacker gets out of it, and how bad it actually is. Ranked, so you know what to fix on Monday morning.

security-report.html
Security auditapp.yourcompany.com
1Critical
2High
1Medium
critical
Any member can read another organization's invoicesGET /api/orgs/:id/invoices
high
Stripe webhook accepts unsigned payloadsPOST /api/webhooks/stripe
high
Password reset token stays valid after useauth/reset-password.ts
medium
No rate limit on the sign-in endpointPOST /api/auth/sign-in

The Markdown report, for your agent

The same findings as precise, file-level instructions. Drop it into Claude Code or Cursor and the fixes are already scoped — no translation from prose to patch.

security-report.md
## FIX-01 — Cross-tenant invoice read **Severity:** critical**File:** `src/routes/api/orgs/$id/invoices.ts:34` The handler trusts `params.id` and never checks that thesession's user belongs to that organization. ```diff- const org = await getOrg(params.id);+ const org = await getRequiredCurrentOrg(params.id);```
Coverage

The classes of bug that actually cost you customers

Not a compliance checklist. This is what gets probed by hand against your running application, in the order an attacker would try it.

Broken access control

Object ids you can change, roles you can escalate, other tenants' rows you can read.

Authentication and sessions

Reset tokens that survive use, OTP brute force, sessions that outlive a logout.

Payments and webhooks

Unsigned webhook payloads, prices trusted from the client, plans upgraded for free.

Injection and input handling

SQL and NoSQL injection, template injection, stored XSS in the fields nobody escapes.

File upload and storage

Content types you can spoof, buckets left public, signed URLs that never expire.

Secrets and exposure

Keys in the client bundle, verbose errors, internal endpoints reachable from outside.

How it works

From payment to report in 48 hours

Four steps, all of them yours except the last one.

  1. Step 1

    Pay with your email

    One payment for one report on one domain. Your email becomes your account on the way back from Stripe — nothing to set up beforehand.

  2. Step 2

    Prove the domain is yours

    A code sent to a role address on the domain, or a DNS TXT record. Takes a minute, and it is the only way this stays legal.

  3. Step 3

    Sign the authorization

    You type your name and grant permission to test that exact domain. Nothing is scanned before that signature exists.

  4. Step 4

    Get both reports

    The audit runs by hand, not by scanner. Both files land in your dashboard within 48 hours of payment.

Authorization

Nothing is touched before you have signed

Testing an application you have not been authorized to test is a crime in most countries. That is why the boring part comes first, and why it is not skippable.

You prove the domain

A code on a role address, or a TXT record only the domain owner can publish.

You sign the scope

Your typed name, your account email, the date, the document version, stored with the run.

You can stop it

Say the word and testing stops. Anything you list as off-limits stays off-limits.

Pricing

The price goes up as reports sell

This is launch pricing, and it only moves in one direction. The tier you buy at is the tier that was live when you paid.

Founding 10Reports 1–10
10 left$100
Next 10Reports 11–20
$149
Next 20Reports 21–40
$199

Once this tier sells out the price becomes $149.

FAQ

Questions worth asking first

Is this an automated scanner?

No. Scanners produce the noise you already ignore. The audit is driven by hand against your running application, and every finding in the report was reached before it was written down.

What do you need from me?

A domain, proof that you own it, and a signature. If part of your app is behind a login you can add a throwaway test account during onboarding; otherwise an account is created through your own sign-up flow.

Do you test staging or production?

Production, unless you say otherwise. You can list anything you would rather not have touched in a free-text note, and it is respected.

Will this take my app down?

No. This is a manual audit, not a load test. There is no volumetric traffic, no denial-of-service testing, and no destructive payload against production data.

What if you find nothing?

You still get both reports, documenting what was tested and what held up. That is a result you can show an enterprise customer during their security review.

Can I audit a second domain?

Yes — that is a second purchase. One payment buys one report on one domain, and there is no subscription to cancel.

What if I never verify my domain?

Nothing happens. The run waits for you, indefinitely. Testing without a verified domain and a signed authorization is not something that gets skipped.

You will find out either way. Better from a report.

One payment, one domain, both reports in 48 hours.

Secure payment by Stripe$100 once, nothing after