Find out what an attacker would find, for $100
A human breaks into your web app on purpose, then hands you two files: an HTML report that explains every hole, and a Markdown report your coding agent turns straight into fixes. Within 48 hours of signed authorization.
No subscription. No account to create first — the email that pays becomes your account.
- Manual, not a scanner
- One domain, one payment
- Delivered in 48h
- Signed authorization first
18 applications audited so far. 13 had a critical or high finding. None came back empty.
18 apps tested. 13 had a critical or high finding.
Every audit run to date, counted from the first full report of each application. Not one of them came back clean — and that is the part founders never believe until it is their app.
- applications audited
- 18
- confirmed findings
- 133
- rated critical
- 17
- apps with nothing at all
- 0
A sample of what has actually been found
- CriticalDelete every conversation in an organization — while signed out
- CriticalPrice and credit count decided by the customer at payment
- CriticalRead any other organization's API keys
- CriticalThe entire users table, readable without authentication
- CriticalFree upgrade to the paid plan through mass assignment
- HighLogin OTP brute-forceable, all the way to account takeover
- HighStored XSS on the public profile pages
- HighPaid application downloadable with no licence check
Every finding above was confirmed by exploiting it, then reported to the owner and fixed. Domain names are never published — yours will not be either.
Your scanner found 200 issues. An attacker needs one.
Automated tools are good at spotting missing headers and outdated packages. They have never once found the endpoint that returns another customer's data, because that bug only exists in your business logic — and nobody wrote a signature for your business.
Scanners test the framework
They know what WordPress looks like. They do not know that your invoice route trusts an id from the URL.
Agencies quote 10k and 3 weeks
A scoping call, an SOW, a kick-off. By the time it starts you have shipped forty commits.
So nothing gets tested
The app goes to production with real customer data and the honest security posture of hope.
One developer, not an agency
My name is Melvyn. I build web applications, and I break into other people's by hand. Nothing is outsourced and no junior is put on your file — the person who reads your code is the person who signs the report.
I am a software developer, not a professional pentester. I hold no degree or professional certification in cybersecurity. This service is an independent security review, not a certified audit or compliance certification.
- Every finding reached before it was written down
- Your domain is never named publicly
- You can stop the test with one message
Two reports, because two different readers have to act on them
A PDF nobody opens twice is not a security audit. You get one file to understand the problem and one file to fix it.
The HTML report, for you
Every finding written for a human: what it is, how it was reached, what an attacker gets out of it, and how bad it actually is. Ranked, so you know what to fix on Monday morning.
The Markdown report, for your agent
The same findings as precise, file-level instructions. Drop it into Claude Code or Cursor and the fixes are already scoped — no translation from prose to patch.
The classes of bug that actually cost you customers
Not a compliance checklist. This is what gets probed by hand against your running application, in the order an attacker would try it.
Broken access control
Object ids you can change, roles you can escalate, other tenants' rows you can read.
Authentication and sessions
Reset tokens that survive use, OTP brute force, sessions that outlive a logout.
Payments and webhooks
Unsigned webhook payloads, prices trusted from the client, plans upgraded for free.
Injection and input handling
SQL and NoSQL injection, template injection, stored XSS in the fields nobody escapes.
File upload and storage
Content types you can spoof, buckets left public, signed URLs that never expire.
Secrets and exposure
Keys in the client bundle, verbose errors, internal endpoints reachable from outside.
From authorization to report in 48 hours
Four steps, all of them yours except the last one.
- Step 1
Pay with your email
One payment for one report on one domain. Your email becomes your account on the way back from Stripe — nothing to set up beforehand.
- Step 2
Prove the domain is yours
A code sent to a role address on the domain, or a DNS TXT record. Takes a minute, and it is the only way this stays legal.
- Step 3
Sign the authorization
You type your name and grant permission to test that exact domain. Nothing is scanned before that signature exists.
- Step 4
Get both reports
The audit runs by hand, not by scanner. Both files land in your dashboard within 48 hours after you sign.
Nothing is touched before you have signed
Testing an application you have not been authorized to test is a crime in most countries. That is why the boring part comes first, and why it is not skippable.
You prove the domain
A code on a role address, or a TXT record only the domain owner can publish.
You sign the scope
Your typed name, your account email, the date, the document version, stored with the run.
You can stop it
Say the word and testing stops. Anything you list as off-limits stays off-limits.
The price goes up as reports sell
This is launch pricing, and it only moves in one direction. The tier you buy at is the tier that was live when you paid.
Once this tier sells out the price becomes $149.
What the payment buys
You may request a full refund before signing the testing authorization. Once signed, you are paying for the audit time, not for a quota of holes. If your app holds up, you still receive both reports documenting what was tested — a clean report costs the same work and is not refundable.
Questions worth asking first
Is this an automated scanner?
No. Scanners produce the noise you already ignore. The audit is driven by hand against your running application, and every finding in the report was reached before it was written down.
What do you need from me?
A domain, proof that you own it, and a signature. If part of your app is behind a login you can add a throwaway test account during onboarding; otherwise an account is created through your own sign-up flow.
Do you test staging or production?
You choose staging or production during onboarding; staging is the safer default. The signed authorization freezes the environment, assets, exclusions and special instructions before anything is tested.
Will this take my app down?
No. This is a manual audit, not a load test. There is no volumetric traffic, no denial-of-service testing, and no destructive payload against production data.
What if you find nothing — do I get a refund?
Before signature, you may request a full refund. After you sign and the audit is scheduled, no: you are paying for the audit time, not a count of findings. You still receive both reports documenting what was tested and what held up.
Can I audit a second domain?
Yes — that is a second purchase. One payment buys one report on one domain, and there is no subscription to cancel.
What if I never verify my domain?
Nothing is tested. The unsigned run waits for you and remains eligible for a full refund from your dashboard.
You will find out either way. Better from a report.
One payment, one domain, both reports within 48 hours of authorization.
Secure payment by Stripe$100 once, nothing after