Find the security flaws in your app before someone else does
Self-service penetration testing for apps, sites and systems — built with or without Artificial Intelligence. Order it, track it and get a digitally signed report.
Free test of your site
A live score from 0 to 100 in about a minute. We only test domains you prove you control.
Test my site for free The free test form is in Portuguese.
What you get
A report you can show to whoever asks.
Vertical privilege escalation — admin panel accessible without authentication
Report digitally signed with GNU Privacy Guard (GPG).
RFC 3161 (Request for Comments 3161) timestamp and an attestation report anyone can verify.
This is how each finding reaches your report. Target data and each client’s evidence are left out of this sample.
What the free test checks
Read-only: what a browser and a mail server already see.
- Secure connection
- HTTPS (HTTP Secure), HTTP redirect and obsolete TLS (Transport Layer Security) versions.
- Protection headers
- HSTS (HTTP Strict Transport Security), CSP (Content Security Policy) and clickjacking protection.
- Session cookies
- Secure, HttpOnly and SameSite attributes.
- Exposed files
- Git repository, .env file and database backups, always with the content validated.
- Version disclosure
- Server name and version in response headers.
- Domain e-mail
- SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting and Conformance).
This is a basic, automatic check. What it cannot reach, a full pentest (penetration test) covers.
Choose a service
The free test shows the basics. Paid plans cover the rest.
Personal
For anyone who built an app, site or system (with or without Artificial Intelligence)
Automatic delivery · self-service
Personal Check
R$ 197.00External recon + non-invasive Open Worldwide Application Security Project (OWASP) Top 10 + Nuclei + passive OWASP Zed Attack Proxy (ZAP). Automatic delivery.
For anyone who launched an app or site and wants a quick external check.
StartPersonal Plus
R$ 347.00Everything in Personal Check + 1 re-test within 30 days after you fix the findings.
For anyone who will fix the findings and wants to confirm the fix worked.
StartBusiness
For companies that need a report that carries weight
A security expert reviews and signs · authorized invasive testing · compliance with the Lei Geral de Proteção de Dados (LGPD), ISO/IEC 27001 (the international information security management standard) and PCI DSS (Payment Card Industry Data Security Standard).
Business Suite
Contact usFull external suite + authorized invasive testing + compliance. Expert review and signature.
For companies that need an expert-signed report and authorized invasive testing.
Business Suite + Code
Contact usBusiness Suite + static source-code analysis (SAST) + dependency audit (SCA).
For companies that also need source-code and dependency analysis.
Below the R$ 20,000–40,000 of a typical market pentest.
How it works
From domain verification to the report.
- Domain verificationYou publish a code on your domain to prove it is yours.
- ContractDigital signature of the term that authorizes testing.
- PaymentTesting only starts after it.
- TestingThey run in the background; you follow progress in the dashboard.
- ReportDigitally signed PDF, with every finding and remediation guidance.
Business also includes an expert review before delivery.
What paid plans test
Full scope and limits in the scope document.
- Open Worldwide Application Security Project (OWASP) Top 10, the ten most common web application risks.
- Static Application Security Testing (SAST), static analysis of the source code (on the code plan).
- Software Composition Analysis (SCA), the dependency audit (on the code plan).
- Nuclei, known-vulnerability scanning.
- OWASP Zed Attack Proxy (ZAP), web application scanning.
Why trust this
What we do before, during and after testing.
- Report signed with GNU Privacy Guard (GPG), an RFC 3161 (Request for Comments 3161) timestamp and an attestation report anyone can verify.
- Domain ownership verification before any testing — via a Domain Name System (DNS) TXT record or a meta tag.
- Authorization Term signed through Clicksign before any testing.
- Data handling under the Lei Geral de Proteção de Dados (LGPD).
- On Business, the security expert who reviews and signs is named in the report.
- No testimonials, logos or made-up numbers on this page — only what we deliver.
Frequently asked questions (FAQ)
Did not find yours? Write to us.
What is a penetration test (pentest)?
It is an audit where we try, in a controlled and authorized way, to find and exploit security flaws in your app or site — the way a real attacker would — and hand you a report of what was found and how to fix it.
How long does it take?
Personal plans are delivered automatically within hours. Business takes 1 to 5 business days because it includes authorized invasive testing and an expert review before delivery.
Do I need to prove the domain is mine?
Yes. Before any testing you confirm domain ownership by publishing a Domain Name System (DNS) TXT record or a meta tag we provide. Without it, the order does not proceed.
What do I get at the end?
A digitally signed PDF (Portable Document Format) report, with every finding rated by severity and paired with remediation guidance, plus the attestation report proving the document is intact.
Is it safe? Is it authorized?
We only start after the signed Authorization Term (through Clicksign) and domain verification. We do not run destructive tests in production; invasive testing is Business-only and always with explicit authorization.
Can I test a staging environment?
Yes. You name the target in the order — it can be a staging or Quality Assurance (QA) environment, as long as the domain is yours and is listed in the Authorization Term.
Talk to an expert
Unsure which service fits your case? Write to us and we will answer.