Loading…
Loading…
You decide what gets tested. Every run stays on the staging or preproduction addresses you name, and we never test production.
The pentest covers the staging or preproduction addresses you name. We do not test production. The code is included only if you connect GitHub, up to 2 repositories.
Every run stays on the staging or preproduction addresses you submit, or that you are allowed to have tested. We do not test production.
A standard pentest only watches the running app, so it misses anything a request never happens to hit.
Code review is the stronger test. We read the project and see the exploits in it: missing access checks, secrets left in the repo, and logic flaws the staging site never shows. Connect GitHub, up to 2 repositories, and that review is part of the pentest. A lot of what matters only shows up there.
No. A pentest covers only the staging or preproduction addresses you name in your scope, and only after you prove you control each one.
Before a pentest starts, you prove control of each address with a DNS TXT record, a file at /.well-known/ghostprobe-verification.txt, or an HTML meta tag. If you act for the owner, such as an agency, the owner completes this step or signs our letter of authorisation. We check again before every run.
The testing agent is instructed to stay on the addresses in your scope, skip any paths you list as exclusions, avoid destructive actions, and never flood your app with requests.
It is stored encrypted with AES-256 and masked as [redacted] in the test logs. Rotate or disable the test account once the pentest ends.
Leaked keys, credentials and personal data are findings, and we report them like any other, with where we found them and how to fix it.
The full commitments are in our Data Processing Agreement, subprocessors and scanner IPs pages.