33 issue types32 written fixes30 tables per scan2 throwaway accountsnothing written$19 report · $39 with 30 nightly re-scans
Does your app actually work?
A security hole leaks the users you have; a broken checkout means you never get them.
Free · no account · a real browser · no payment is ever completed
THREE FLOWS, IN A REAL BROWSERWhat the agent drives, and what it has to see before it calls the flow a pass.
NOT RUNSign upCreates a throwaway account through your real signup form, submits it, and follows wherever the app sends it next.WHAT COUNTS AS A PASSIt lands somewhere logged-in — not a blank screen and not an error.
NOT RUNCheckoutWalks to your pricing page, picks a plan and starts a purchase. It never completes a payment.WHAT COUNTS AS A PASSA real payment step is reached.
NOT RUNPassword resetRuns “forgot password” with the address it just signed up, and reads what comes back.WHAT COUNTS AS A PASSThe app accepts the request instead of throwing — the flow founders never test on their own app.
Same URL in, report out — the smoke test shares the security scan’s funnel. Run both before you launch, and again whenever you ship a change.