PRICING / A CLEAR SCOPE AT EVERY LEVEL
The right depth.
The right expertise.
Start with useful public observations. Move to authorized automation or a scoped human review when the release needs more certainty.
Automated observationsSurface Check
$0
$0
A bounded look at TLS, security headers, cookies and the public client-side surface. No registration required.
Run free check ↗A1 · Automated + validatedVerified Scan
$299
$299
Verify domain control, authorize the scope and run an extended automated assessment. High-impact candidates require manual validation.
Verify & continue ↗H1 · Human reviewedSecurity Review
From $2,500
$2,500–4,500
Automation plus a targeted human review of your application, API and supplied repository. Reviewer planning: 2–6 hours.
Request scope ↗H2 · Senior pentesterWeb / SaaS Sprint
From $7,500
$7,500–10,000
Scope-specific penetration testing, business logic and authorization review, evidence-led reporting and one retest.
Request scope ↗H2 + W3 where requiredWeb3 / Mainnet
From $10,000
$10,000–18,000+
Review the boundary between your application, wallet and on-chain intent. Chain-specific findings require an appropriate specialist.
Request scope ↗Scope-based release assuranceContinuous Assurance
From $750/mo
$750–3,000+/month
Compare releases against an accepted baseline, preserve critical flows and investigate real regressions. No destructive automatic production scans.
Discuss continuity ↗ Scope first. Then a precise quote.
Verified Scan is $299 upfront for the agreed automated scope. Variable-tier prices are starting points, not automatic final quotes. High-ticket engagements typically use a 50% deposit and 50% before the final report, adjusted in the accepted quote.
Specialist capacity is verified before delivery. H1 review is required for Security Review; H2 for Web/SaaS and Web3 sprints; W3 for chain-specific wallet/on-chain findings where required. No invented reviewer profiles imply staffed availability.
A potential critical finding escalates to senior review regardless of package. A checkout never replaces domain control and explicit authorization.