built for the agentic era
find what attackers would find.
before they do.
verified external findings. priced by severity.
recon.sh tests the parts of your app anyone on the internet can reach, proves each issue is real on your live site, then hands you the exact bug and the fix.
a finding is one specific way in. 5 credits to scan. 1 credit = $1. the severity summary is included. unlock only the findings you want.
or see how pricing worksthe problem
your app is live. the only ones testing it aren't on your side.
every app gets its first real security test eventually. the only question is whether you commissioned it, or an attacker volunteered. three reasons most startups are still untested:
a real pentest is out of reach.
$10k-$50k, booked weeks out, scoped for enterprises with compliance deadlines. not for a product that shipped last month.
scanners don't understand your app.
off-the-shelf scanners check for known bugs in known software. the dangerous flaw is in the logic you wrote last sprint - no signature list knows it exists.
attackers already use ai.
the people probing your login page run automated, agentic tooling around the clock. a once-a-year security review is defending against offense that iterates nightly.
the fix
three steps. one afternoon.
log in. prove the domain is yours.
sign in with an email link. no password. then one dns txt record. about a minute.
run the outside-in scan.
5 credits starts it. we scan everything reachable on the internet: your main site, your subdomains, your apis. give us a throwaway test login to check the logged-in parts. give us two, and we test whether one user can reach another user's data.
unlock only what matters.
the severity summary comes with the scan. info findings are free to read. verified findings unlock by severity, paid with credits. if one doesn't reproduce for you, its credits come back (see terms).
evidence
the full finding. reproduced.
every unlocked finding ships with the request, the response, a working repro, and how to fix it. the engine re-ran it against your live target before it shipped. if it can't be reproduced from that evidence, its credits come back.
in plain terms: any logged-in customer could pull another customer's invoice by changing one number in the url.
reproduction
- create two test accounts (tenant_a, tenant_b).
- authenticate as tenant_a, request
/api/invoices/{id}. - replace
idwith a tenant_b invoice id. - server returns invoice metadata without ownership validation.
evidence
GET /api/v1/invoices/4421 HTTP/1.1 Host: app.acme.dev Authorization: Bearer eyJhbGciOi...
HTTP/1.1 200 OK
Content-Type: application/json
{ "invoice_id": "inv_4421",
"tenant_id": "tenant_b",
"amount": "$24,113.00" }tenant_a token accessed tenant_b invoice.
the fix
enforce tenant ownership check before object retrieval. add an integration test for the cross-tenant case. the full fix and a regression test ship with the unlocked report.
// fix // GET /api/invoices/:id - const invoice = await Invoice.findById(req.params.id); + const invoice = await Invoice.findOne({ + _id: req.params.id, + tenantId: req.tenant.id, + }); + if (!invoice) return res.status(404).end();
pricing
pay for the scan. unlock what's worth fixing.
paid with credits. 1 credit = $1. no subscriptions. attestation letter included with every scan.
- 01
buy credits
one balance for scans and findings. credits never expire.
- 02
run a scan
5 credits a scan. you get the severity summary of everything found.
- 03
unlock what matters
spend credits on the findings you want, priced by severity. informational is free to read.
what it costs
- scanincludes the severity summary
- 5 credits
- critical
- 499 credits
- high
- 199 credits
- medium
- 99 credits
- low
- 49 credits
- informational
- free to read
unlock 2+ paid findings together: the priciest at full price, 30% off every other one.
credit packs
- $2525 credits
- $100100 credits
- $250275 credits +10%
- $500575 credits +15%
- $10001200 credits +20%
credits never expire.
tax, where it applies, is shown at checkout when you buy credits.
scope & limits
we're honest about what this is - and isn't.
external-only.
we test what is reachable from the internet. no repo access. no internal agents. no source code review.
non-destructive.
safe against production. we don't delete data, drop tables, or leave anything behind. if a test has to change something, we record it and put it back. some actions have side effects we can't undo, like an email your app sends on signup, so tell us which flows to avoid.
credentials, disclosed.
if you provide test credentials, they pass through a third-party ai provider, the one that runs the scan, not us. we delete our stored copy when the scan starts, or after 24 hours if it hasn't started. the scanner deletes its copy when the scan ends. rotate them when it's done.
we prove it, or your credits come back.
every unlocked finding must reproduce from the shipped evidence. if it doesn't, you get back the credits it cost.
full disclosure: /trust
questions
is it safe to run against production?
yes. we don't delete anything, drop tables, or modify your data. if a check would trigger a state change (a signup, a password reset), we snapshot first and restore after. you'll see traffic from a few of our ips in your access logs during the scan, that's about it. if you've got rate-limiting or a waf, we work inside it.
what should i point it at - the apex or a subdomain?
wherever the actual product lives. if your app is at app.acme.com, scan that. if the apex is your marketing site, scan the marketing site separately. we crawl outward from the starting point, so it matters more than people expect.
how is this different from an automated scanner (the kind you might run yourself)?
scanners check your app against a list of already-known bugs and common setup mistakes. they won't find the login flow you wrote last sprint, or a bug where changing one id in a url hands you another user's data. those are flaws in how your app is meant to work, and catching them needs something that understands what your app is for.
how do i know the findings are real and not an ai making things up?
because we don't ship a finding until it's been reproduced. the engine re-runs each one against your live target and packages the request, the response, and a working repro - so you can run it yourself. it's a structured red-team methodology over a real toolchain, not a one-shot prompt. if a finding can't be reproduced from the evidence we ship, you get back the credits it cost. that verification step is the product.
how does this fit alongside a traditional pentest?
we cover the external part - subdomain enumeration, auth flows, business logic, idors, exposed apis. a traditional pentest covers all of that plus what we don't do: source review, internal network, social engineering, secrets in code, host hardening. most teams run us first to cover the external surface the same day, then book a pentest if they need the rest, or if compliance (soc 2, hipaa, fedramp) wants a firm's letterhead.
how do credits work?
you buy a pack of credits, then spend them: 5 credits to start a scan, and each finding you unlock at its severity price. bigger packs carry a bonus, up to +20%. no subscription.
what do i get back, and when?
a finding that doesn't reproduce from its evidence: the credits it cost come back. a scan that fails or times out: its 5 credits comes back as credits, to the pack it came from, automatically. unused credits in a pack: refundable in cash, proportionally, within 14 days of buying it. credits we give back for a finding that did not reproduce stay credits, except as the law requires. findings bought through our earlier per-finding checkout keep their cash refund.
who can see my report?
only you. you log in with an email link, and a report opens only for the account that ran the scan. to show someone else, create a share link: read-only, no prices or credits on it, and you can revoke it any time. a copy someone already downloaded stays with them.
do credits expire?
no. unused credits stay on your account until you spend them. the 14-day window only decides whether you can still cancel a pack for cash back; closing your account refunds unused paid credits at any time.
see what an attacker can find. before they do.
5 credits to scan. pay for the findings you unlock. credits back if one doesn't reproduce.