Penetration testing, run by people
Automated scans catch the flaws that look like patterns. A penetration test catches the ones that need a human to reason about them - chained exploits, broken business logic, and the assumptions your architecture makes about its own users. Request one against any domain you control.
You will need a FlawPilot account and control of the domain you want tested. Verification is a single DNS TXT record.
What a manual pentest adds
Business-logic flaws
A scanner cannot know that your refund endpoint should never accept a negative amount. A tester can, and will try it.
Chained exploits
Two low-severity findings that are harmless alone can combine into account takeover. Chaining them takes a human working through your app the way an attacker would.
Authorization gaps
Testing whether one user can reach another user role’s data means holding two sessions and reasoning about intent - exactly what automation is worst at.
Evidence you can act on
Each finding arrives with reproduction steps and the impact spelled out, so your engineers can fix it without reverse-engineering the report first.
Black-box testing
We test the way an external attacker would: no source code, no credentials, no architecture diagrams. Whatever is reachable from the public internet is in scope, and nothing else is.
- ✓Your live site or API, at a domain you have verified
- ✓No knowledge of internal systems is assumed or used
- ✓Testing is non-destructive - we prove a flaw exists, we do not exploit it further
- ✓Findings are reported to you and to nobody else
How it works
Four steps from request to report. The only work on your side is the first two.
Verify your domain
Add one DNS TXT record to prove you control the domain. This is the step that makes the whole thing lawful - we will not test a domain nobody has proven they own.
Submit your request
Tell us the domain and, optionally, where to focus - authentication, payment flows, API surface, whatever worries you most.
We test
A security engineer works through your application manually. You can follow the status of your request from your dashboard at any time.
You get the report
Findings arrive with severity, reproduction steps, and remediation guidance. Fix, then request a re-test when you are ready.
Why we verify ownership first
A penetration test is an active attack against live infrastructure. Running one against a domain you do not control would be unauthorized - illegal in most jurisdictions, and a good way for both of us to end up in a difficult conversation. So we require proof first, every time, with no exceptions and no way to skip it.
The record you will add
- Type
- TXT
- Name
- flawpilot-verify.example.com
- Value
- verification=<your token>
DNS changes can take up to 24 hours to propagate, so verification may not succeed on the first attempt. Nothing is lost - just try again once the record is live.
Frequently asked questions
Tell us what to test
Give us the domain and how to reach you. You'll continue in the app to verify the domain and confirm scope.