Check my app
Tell us your website address in plain English — we'll find your backend, check the common ways small apps leak data, and explain what we find (and how to fix it) without the jargon.
Add test logins (optional — lets us check what each type of user can reach)
Give a username & password for a test account of each type on your app. We use them once to check permissions and never store the password. Use test accounts on a staging copy.
Quality Overview
One rollup across every testing discipline — security, integration, performance and accessibility — plus your engagement go-live status.
Teams & Access
Create teams, invite colleagues with roles, share engagements, and manage API tokens for CI/automation.
Security Dashboard
Your combined security picture.
- Complete an assessment to see priorities.
Run scans over time to see a trend.
Complete the posture assessment more than once to see a trend.
External Vulnerability Scan
Passive, non-intrusive checks on your public website, TLS, DNS and email security.
Domains & Monitoring
Verify ownership of a domain to unlock scheduled monitoring and email alerts.
Security Posture Assessment
A quick self-assessment of the controls that matter most for small businesses.
Phishing Simulation
Run a training campaign against your own staff and track who clicks vs. who reports it.
New campaign
Professional Engagements
Scope a formal penetration test, run the crown-jewel authorization checks against a Supabase target, track findings with CVSS, and export the Rules-of-Engagement and report PDFs.
Integration Testing (SIT)
Build API test suites — ordered request steps with assertions (status, JSON-path, body, response time) and value capture between steps. Runs real requests: target only systems you own or are authorized to test.
Performance / Load Testing
Send a capped burst of concurrent requests and measure latency percentiles, throughput and error rate. Authorized targets only; volume is limited so this stays a load test, not a denial-of-service.
Accessibility (a11y) Check
Static WCAG checks on a page's HTML — missing alt text, labels, language, heading order, landmarks and more. Complements (doesn't replace) a screen-reader and contrast review.
Code & Dependency Scan
Two offline checks: find known-vulnerable npm packages, and catch secrets hard-coded in your source. Nothing you paste leaves the server; secrets are redacted in results.
package-lock.json (preferred) or package.json. Screened against a curated advisory database — run npm audit for the exhaustive live set..env content. Finds API keys, private keys, tokens and hard-coded secrets. Matches are redacted; a Supabase service_role JWT is flagged Critical (the public anon key is ignored).Go-Live Readiness Check
Run the full spec of URL-based tests against a target before launch — or pick specific suites — and get one go / no-go verdict. Authorized targets only; DAST sends active (bounded) probes.
🔐 Authenticated scan (optional) — test behind login, where most bugs live
Alerts
Changes detected by scheduled monitoring of your verified domains.
Outbox
Every email the platform generates — alerts and phishing-simulation messages. In production these would be delivered by your email provider.
Assessment Report
A consolidated summary you can print or save as PDF.
Admin
Platform control plane — organizations, usage, service health and backups.
Loading…
Account & Security
Protect your account with multi-factor authentication, manage your signed-in devices, and control your workspace data.
Loading…
Jobs
Background runs — scans, deep checks, load tests and report exports run here so they don't block your session. This list refreshes automatically while work is active.
Loading…
Plan & Usage
Your workspace plan, what it includes, and how much you've used this month.
Loading…