Pricing that pays for itself

It is the cheapest plan with the full CI/CD path, the public certificate, compliance mapping and 1 project — everything a SaaS team needs to pass enterprise procurement. Most teams land on SaaS after the free Dev scan.

The Dev plan is free forever and runs the full OWASP baseline suite over the CLI, so you can evaluate the product with zero risk. Upgrade to Live for online monitoring and a certificate, or to SaaS for the full CI/CD path, Hacker mode, Ask mode and compliance exports.

Yes. The scanner runs in a sandbox with strict pacing, timeouts and request caps. You choose the schedule and can pause anytime.

Yes — an automated API penetration test. We run OWASP API Top 10 attack simulations (BOLA/IDOR, broken auth, injection, mass assignment, rate limiting, CORS, security headers, shadow APIs) plus deep-scan tests (JWT weaknesses, HTTP method tampering, privilege escalation via mass assignment, server tech fingerprint with EOL versions) on demand or on a schedule, like an automated pentester. It complements a human-led manual pentest rather than replacing it.

Yes. Add your API or paste an OpenAPI spec and hit “Run live pentest” — the sandbox starts testing immediately and you watch it live in the terminal. The same test is also available from our CLI (liveapisec scan) for your CI/CD.

An autonomous AI agent that runs a real, human-style penetration test on your API (dev/staging only, never production): it plans an attack, probes endpoints step by step — trying IDOR, broken auth, injections, secrets and mass assignment — observes the responses, self-corrects and writes a final evaluation with fixes. It can even write and run its own probe code in a sandbox. It runs manually on demand, requires a verified domain for public targets (localhost / private IPs are exempt), and your URL and credentials are never sent to the AI. We strongly discourage running it against production — it can break or destroy a system.

Credentials are encrypted with AES-256-GCM at rest and are only decrypted in memory during a scan. They are never logged and never shown in plaintext.

It means the API passed the automated OWASP API Top 10 tests in the tested scope on a specific date. We never claim absolute security — the certificate wording is deliberately precise.

You prove ownership with a DNS TXT record (or a manual confirm in lower tiers). Every authorization is recorded with timestamp and scope.

An endpoint is a unique HTTP method + path in a project (e.g. GET /users). Endpoints are summed across all your projects; environments share the same spec, so they do not multiply the count. Your dashboard shows live usage (X / Y endpoints) so you always know where you stand.

Every plan includes the OWASP API Top 10 baseline suite and the full Deep-scan suite. The Dev plan is CLI-only for developers (no online certificate, no scheduled scans). The Live plan adds continuous online monitoring and a public Trust Page, but no CLI/CI-CD. The SaaS plan gives you both CLI/CI-CD and the certificate, plus compliance mapping. Hacker mode (AI) starts at SaaS; Ask mode (the code questionnaire) starts at SaaS. Enterprise extras (SOC 2 report, SSO, priority queue, SLA) are on Enterprise.

A manual pentest is a snapshot: $15k+, 2–4 weeks of waiting, outdated on your next deploy. We run the same OWASP attack classes continuously — every deploy, every night — for less than a tenth of the price. Use us to stay clean year-round and bring humans in once a year for the exotic stuff.

No. Standard scans are read-only probes with polite pacing, hard time/request budgets and an isolated sandbox — they cannot modify your data. Only Hacker mode (AI) is destructive, which is exactly why it is blocked from production entirely and runs on dev/staging only.

You get an alert in seconds — email, Slack or webhook, your choice — with the finding, the evidence and the fix. Critical and high findings can also block the deploy via our CI verdict endpoint, so the vulnerability never reaches production in the first place.

Yes. Upgrade is instant, downgrades apply at the next billing cycle, and you keep every existing scan and certificate. Paid plans include a 14-day money-back guarantee.