Tier 3 · Pentest · Live now

What's actually in our $5 pentest.

No marketing fluff. This page lays out exactly what we test, what we don't, what the deliverable looks like, and how we compare to a traditional pentest consultant. If anything's unclear, contact us before paying.

$5USD · per target · one-time
// What we test

15 categories. 68 individual probes.

Every check listed below runs on every pentest. Each finding in your PDF report includes the exact HTTP request that triggered it, the response we received, the CVSS 3.1 vector, the relevant OWASP / CWE references, and concrete remediation steps. Methodology is drawn from OWASP Top 10 2021, OWASP API Top 10, CWE Top 25, and PCI-DSS / NIST controls where applicable.

Deployment 4 probes

Configuration mistakes on production servers — outdated software, debug modes accidentally left on, internal files leaked through the web.

  • Known vulnerable software versions
  • Verbose error messages
  • Development artifacts in production
  • Directory listing

Information Disclosure 5 probes

Recon data we leak to attackers without realising — server versions, internal comments, framework fingerprints.

  • Verbose server banners
  • Sensitive HTML comments
  • Exposed metadata files
  • Technology stack fingerprintability
  • CMS version disclosure in HTML

Transport Security 6 probes

HTTPS configuration, certificate validity, redirect behaviour, and protection against downgrade attacks.

  • HTTPS is enforced
  • Valid TLS certificate
  • HTTP redirects to HTTPS
  • HTTP Strict Transport Security
  • Mixed content
  • CAA DNS record

Security Headers 5 probes

Modern browser security primitives (CSP, X-Frame-Options, etc.) that block whole classes of attack when configured correctly.

  • Content Security Policy
  • X-Frame-Options
  • X-Content-Type-Options
  • Referrer-Policy
  • Permissions-Policy

Cookies & Sessions 5 probes

How cookies are scoped, who can read them, and whether they protect session integrity correctly.

  • Secure flag on cookies
  • HttpOnly flag on cookies
  • SameSite attribute on cookies
  • __Host- or __Secure- cookie prefix
  • Cache-Control: no-store on sensitive responses

Authentication 4 probes

Login forms — discoverable, rate-limited, CSRF-protected, with sensible password policies.

  • Login form discoverability
  • Rate limiting on login
  • CSRF protection on state-changing forms
  • Password policy strength

Authorization 2 probes

Once a user is logged in, can they see or do things they shouldn't?

  • Exposed administrative interfaces
  • IDOR (Insecure Direct Object References)

Injection 9 probes

The OWASP-classic exploit categories — SQL injection, XSS, command injection, traversal, SSRF, SSTI, XXE.

  • SQL injection
  • Reflected XSS
  • Command injection
  • Path traversal
  • Open redirect
  • Host header injection
  • XML External Entity (XXE)
  • Server-Side Request Forgery (SSRF)
  • Server-Side Template Injection (SSTI)

API Security 4 probes

Surface-level API misconfigurations — permissive CORS, unsafe HTTP methods, GraphQL introspection, JWT pitfalls.

  • CORS misconfiguration
  • Dangerous HTTP methods
  • Test GraphQL endpoints for introspection
  • Test JWT implementation

Client-Side 3 probes

JavaScript bundles shipped to browsers — leaked secrets, unsafe inline handlers, missing integrity checks.

  • Hardcoded secrets in JavaScript
  • Inline event handlers
  • Subresource Integrity (SRI)

Email Security 3 probes

DNS-level email auth (SPF, DKIM, DMARC) that prevents your domain from being spoofed.

  • SPF record
  • DMARC record
  • DKIM signing

DNS 2 probes

Domain-level reconnaissance — subdomain enumeration, zone-transfer attempts.

  • Discoverable subdomains
  • Unauthorized DNS zone transfer

Network 3 probes

Network-level checks against the target host — administrative ports exposed, sensitive files reachable, security.txt.

  • Administrative endpoints exposed to the internet
  • Sensitive files exposed via HTTP
  • /.well-known/security.txt

SEO & Discoverability 6 probes

Search-engine and crawler signals — robots.txt, sitemaps, titles, descriptions, social-share tags.

  • Robots.txt
  • Sitemap.xml
  • Page titles
  • Meta descriptions
  • Open Graph tags
  • Viewport meta tag

Site Quality 7 probes

Hygiene checks that signal a professionally-maintained site (and prevent simple footgun bugs in production).

  • Valid HTML doctype
  • Lang attribute on <html>
  • <h1> usage
  • Alt text on images
  • Console.log() in production
  • Excessive HTML page weight
  • Favicon
// What you receive

A 60-page PDF report. Password protected.

Within ~6 minutes of payment, you receive an encrypted PDF by email. The password is sent in a separate email. The format follows the layout used by professional pentest firms — same sections, same severity scheme, same evidence requirements.

01

Executive summary

One page suitable for non-technical stakeholders: count by severity, top 3 risks, business impact, recommended next steps.

02

Methodology & scope

What we tested, how, what was out-of-scope, what tools we used. Useful for compliance audits.

03

Findings table

Every finding with severity (Critical / High / Medium / Low / Info), CVSS 3.1 vector, CWE reference, OWASP category, status (Confirmed / Likely / Informational).

04

Per-finding detail

For each finding: description, technical impact, exact HTTP request that triggered it, response evidence, proof-of-concept payload, and remediation guidance with code samples.

05

OWASP / CWE mapping

Cross-reference table mapping each finding to OWASP Top 10 2021 categories, CWE Top 25, and where applicable, NIST and PCI-DSS controls.

06

Appendices

Full request/response logs for confirmed findings, TLS report card, scan timing data, and a checklist of all 200+ tests performed.

// Scope

What's in, what's out.

Be honest with yourself: this is automated black-box testing, not a manual pentest by a human. It catches what humans test for first, fast, and at scale — but it can't replace a $5,000+ manual engagement for complex application logic flaws.

Included

  • Reflected XSS in standard contexts
  • Time-based blind SQL injection
  • Path traversal & LFI probing
  • Directory / subdomain bruteforce
  • Permissive CORS policies
  • Login rate-limit testing
  • JavaScript secret scanning
  • Security header audit
  • TLS configuration audit
  • Cookie attribute audit
  • Information disclosure
  • Common file exposure (.git, .env)

NOT included

  • Stored XSS (requires authenticated access)
  • Business logic flaws
  • Privilege escalation testing
  • Authenticated session attacks
  • Social engineering / phishing
  • Physical security testing
  • DDoS / load testing
  • Brute force on real user accounts
  • Mobile app testing
  • Network-layer testing (Layer 3/4)
  • Manual exploit chain development
  • Post-exploitation activities
// Honest comparison

Us vs. a traditional pentest engagement.

We're not pretending to be a $50,000 boutique pentest firm. We're filling a different gap — fast, cheap, automated checks for the things that get exploited most often in the wild.

Traditional pentest consultant

Price₹50,000 – ₹5,00,000
Turnaround2–6 weeks
CoverageCustom logic flaws
MethodologyManual + tooling
Re-test includedUsually
NDA requiredYes
Best forCompliance audits, complex apps

GetCodeAudit $5

Price$5 USD (~₹425)
Turnaround~6 minutes
CoverageOWASP Top 10 + common misconfigs
MethodologyAutomated black-box
Re-test includedNo, but $5 to re-run
NDA requiredNo (consent form only)
Best forPre-launch checks, ongoing monitoring
// FAQ

Questions we get asked.

How accurate are the findings?

Every finding includes the exact request and response that triggered it, so you can verify yourself. We mark findings as Confirmed (we got concrete evidence — e.g. an XSS canary reflected unescaped), Likely (strong signal but couldn't fully exploit, e.g. time-based SQLi with ambiguous timing), or Informational (best-practice violation, not directly exploitable). False-positive rate for Confirmed findings is under 2% on our internal benchmark.

What if I'm not authorized to test the target?

Don't pay. The checkout form requires you to confirm in writing that you own the domain or have explicit written authorization from the owner. Lying on that form makes you personally liable under Section 43 of the Indian IT Act 2000 (or your local equivalent). We log your IP and timestamp at order placement and will share that with law enforcement if served with a valid request.

How long does the scan take?

Typically 5–10 minutes for a small-to-medium site (under 200 pages). Larger sites or slower servers can take up to 30 minutes. You'll see live progress on the scan-status page during the run, plus get an email when the report is ready.

What if the scan fails?

You get an automatic full refund. Razorpay returns the money to your original payment method within 5–7 working days (or faster via instant refund for cards). You'll receive an apology email when the refund is initiated, and a confirmation email when it's been processed.

Will the scan crash my site?

Almost never. We rate-limit ourselves to ~10 requests per second per target and back off on 5xx responses. We don't use any actually-destructive payloads (no DROP TABLE, no infinite loops, no recursive directory creation). That said, if your site is hosted on a tiny VPS with no caching, you may notice elevated load during the scan window.

Do you store findings after delivering the report?

Yes, for 30 days, so you can re-download the report if you lose the PDF. After 30 days, the findings table is purged automatically. The order record (your email, target URL, payment ID) is retained for accounting purposes per Indian tax law.

Can I scan the same target multiple times?

Yes. Each scan is $5 and a fresh order. Many customers run a scan before launch, fix the findings, then run another scan to confirm. There's no discount for repeat orders right now, but we may add one once we have stable volume.

What about white-label / agency pricing?

Email support@getcodeaudit.com if you'd like to scan more than 10 targets per month. We'll set you up with bulk pricing and an API key.

Is the PDF really password-protected?

Yes. The PDF uses AES-256 encryption. The password is generated per order and sent in a separate email from the report PDF, so even if your email account is compromised, an attacker needs to compromise both messages to read the findings. You can also re-download from the scan-complete page using the email verification gate.

Why so cheap? What's the catch?

No catch. We built the scanning engine once and the marginal cost per scan is just compute + bandwidth, which is pennies. We price it where small businesses and indie devs can actually afford it — that's a market traditional pentest firms can't reach. We make money on volume, not margin per scan.

Run your first pentest.

$5 USD. ~6 minutes. 60-page PDF in your inbox.

Start pentest →

Or read the pentest Terms of Service first.