The free scan shows you exactly what a stranger can read, with proof. No card, no account.
For $19 you get the fix written for your app, the deep scan that checks whether a stranger could also change or delete your data, re-runs to confirm it is closed, and 30 days of monitoring with email alerts. One payment, no subscription.
Everything it found, by name: the table, the row count, the endpoint, the leaked key, plus the request we sent and what your app sent back. No blur, no "3 issues found, pay to see them". You know exactly what is open before you decide anything.
Four things. The fix, as a prompt written for your app that you paste into Cursor or Claude Code. The deep scan, which tries to write and delete through every open door, chains them together, and reads six times as many pages. Five deep scans of that app, so after you fix it you can see the doors are closed. And 30 days of monitoring: we re-check the app on our own schedule and email you if a change opens something high or critical.
Before it tries any write, it checks that your database confirms test writes get rolled back. If your database doesn't confirm that, the write tests are skipped and the report says so. Database triggers can still fire on a rolled-back write.
No. $19 once, for one app. There is nothing to cancel. The monitoring runs for 30 days and then stops on its own; buying the fix + deep scan again gives you another 30 days.
No. We test from the outside, the way a stranger would. Paste your URL and go.
Sign in with the email you paid with. Your plan, invoices, and cancellation are on the account page.
No. We only scan apps you confirm you own or have permission to test. That's the deal.