Authentication
Can someone sign in as somebody else, guess passwords or bypass login steps?
Technical details
Session handling, MFA bypass, password reset flows, brute-force protection.
Complimentary assessment
Find the weaknesses in your website. Completely free.
Request a complimentary AI penetration test for your website or application. Verify your website, agree the scope with our team, and receive clear findings with practical next steps.
- £0
- No payment details required
- No obligation to purchase
Illustrative exampleexample-shop.co.uk
Assessment summary
- High
- 1
- Medium
- 1
- Low
- 1
- HighCustomer records reachable by changing an ID in the address
- MediumChat assistant reveals part of its hidden instructions
- LowMissing security header on login page
How it works
Four simple steps
- Step 1
Request your test
Tell us about your business and the website or app you’d like assessed. It takes about five minutes.
- Step 2
Verify your website
Add a small DNS record or upload a file to prove you control the website. We guide you through it.
- Step 3
Agree scope and authorisation
Our team agrees exactly what will be tested, when, and what is excluded — in writing.
- Step 4
Receive findings
Get a clear summary with severity ratings and practical steps to fix what we find.
What we assess
The weaknesses attackers look for first
Coverage depends on your application and the scope we agree for the complimentary test.
Access control
Can one customer see or change another customer’s information?
Technical details
IDOR/BOLA, privilege escalation, multi-tenant isolation.
Input validation
Does the site safely handle unexpected or malicious text typed into forms?
Technical details
XSS, SQL/NoSQL injection, SSRF, template injection.
Sensitive information exposure
Is private data, configuration or secrets visible where it shouldn’t be?
Technical details
Verbose errors, exposed files, insecure headers, data leakage in responses.
Web and API weaknesses
Are the behind-the-scenes connections your site relies on properly protected?
Technical details
API authorisation, rate limiting, CORS, OWASP Top 10 / API Top 10 themes.
For AI-powered products and assistants
Prompt injection
Can someone trick your chatbot or assistant into ignoring its instructions?
AI data leakage
Could your AI reveal private documents, customer data or its own hidden instructions?
AI tool and action permissions
If your AI can take actions — send emails, look up records — are those actions properly limited?
What you receive
Clear, practical results
- A scoped assessment agreed with you in advance
- A findings summary written in plain English
- Severity ratings so you know what to fix first
- Supporting evidence where appropriate
- Practical remediation guidance for your team or developer
Who it’s for
Business websites
SaaS platforms
AI applications
Chatbots
AI agents
Preparing to launch
Why website verification is needed
We only assess websites you own or are authorised to have tested.
Testing someone else’s website without permission is illegal under the Computer Misuse Act 1990. A quick verification step proves you control the website you’ve named. It doesn’t start any testing — that only happens once we’ve agreed the scope and you’ve given written authorisation.
Two easy ways to verify:
DNS record — best if you manage your domain (e.g. at Cloudflare, GoDaddy or 123 Reg).
File upload — best if you or your developer can upload files to the website.
Read the verification guidesComplimentary AI penetration test
£0
No payment details required · No obligation to purchase · No hidden fees
A complimentary assessment covers one agreed hostname and a time-boxed review agreed with our team.
We review applications in the order received and accept a limited number each month.
Request my free AI pentestFAQ
Questions, answered
Ready to see how your website holds up?
Start your application now. It takes about five minutes, and you can save and come back at any time.
Request my free AI pentest