01The target
You name the target. Nothing else.
No agent to install, no code access, no credentials. A domain is enough — everything happens from the outside, the way a stranger sees you.
A full external pentest of everything you expose. Every finding comes with where it sits, the proof and the fix — and if nothing serious turns up, no invoice.
From a bare domain to a fix you can hand to whoever owns that code — the whole way, in order, nothing behind a click.
No agent to install, no code access, no credentials. A domain is enough — everything happens from the outside, the way a stranger sees you.
We will not touch a host you have not proven. Two independent resolvers have to agree — a single one can be stale or redirected, and ownership is the only ticket in.
Phases report live, and you decide how hard we push your production system. What we have not built says skipped instead of showing a progress bar for work nobody did — an invented number would be worse than an honest gap.
How many and how bad costs nothing. If nothing serious was proven, the run is waived and you are never charged — that is the whole pricing model in one sentence.
Every finding was reproduced with different parameters before it reached your list. 41 candidates did not survive that step. This is why the report has three lines and not 1,428.
A suggestion, not a pull request. We never write to your code and never hold credentials — the whole test runs read-only from the outside. What you do with it is your call.
Looking costs nothing. Not looking costs everything.
The check is free. You only pay when we prove something serious — and then it is €199 against a number you do not want to calculate.
A booked penetration test is worth its price. It is also a project: scoping calls, a slot in someone’s calendar, a week of testing, a week of writing.
A pentest is a snapshot of one day. You ship every week, and the report starts ageing the moment it is written. This takes minutes — run it again the day you ship, and again after the fix, free, for fourteen days. Every finding names where it sits, the request that proves it and what to change, so it goes straight to whoever owns that code.
A leaked key is never one finding. It is your database, your storage and your payments in someone else’s hands — and nobody warns you first. The free check takes ten minutes and nothing from your team.