Proof, not guesswork

Exploit. Prove. Advise.
Re‑test.

AI penetration testing for web apps, APIs & SaaS

An autonomous pentest for your web app, API or SaaS. Get proven vulnerabilities, human-reviewed findings and clear remediation guidance — with a retest after you ship the fix.

Test my site View sample report

Human-reviewedRetest included

Built for web apps, APIs & SaaSExplore the risks

The scale of it

Small openings.
Far-reaching consequences.

A single weakness can connect your users, your data, and your infrastructure.

01 / Identity

Account takeover

Broken authentication can turn one session into access to someone else’s account.

Explore the risk ↗02 / Authorization

Cross-tenant access

Missing ownership checks can expose another customer’s records.

Explore the risk ↗03 / Secrets

Exposed API keys

Leaked credentials can unlock the services connected to your application.

Explore the risk ↗04 / Application security

One weakness. Real impact.

Follow the chain from an exposed input to a proven result. See what is reachable, what is at risk, and what needs to change.

Follow the agent ↗05 / Data access

Database exposure

SQL injection or broken access rules can reveal private application data.

Explore the risk ↗06 / Browser

Stored XSS

Untrusted content can execute in a user’s authenticated browser.

Explore the risk ↗07 / Infrastructure

Internal service access

SSRF can let an attacker reach services your public app should never expose.

Explore the risk ↗

02 / AI + human expertise

Independent thinking. Shared purpose.

Autonomous
testing.
Human judgement.

The agent explores your application. A human reviews every finding. You get evidence and a clear next step.

See what your report includes
Agent exploresHuman reviewsProof delivered
  1. 01

    Explore with intent.

    The agent maps and tests your application.

  2. 02

    Review with care.

    A human checks the findings and evidence.

  3. 03

    Move forward clearly.

    Fix guidance, followed by a retest.

When access is needed, a human provides an authorised session so testing can continue.

The outcome

A finding you
can act on.

See what an attacker can reach, review the evidence, understand the fix, and verify the change with a retest.

Explore a sample report
PROOF REPORTFictional sample

Authorization / API

One account.
Another customer’s data.

A changed record ID exposes a different account’s private profile.

Expected✓ Access denied
ObservedPrivate record returned
EvidenceRequest / response
Fix guidanceClear remediation
RetestChange verified
ATTACK PATHSeverity: high
01 · RECON

Mapped API

Found /api/profile/:id

02 · ACCESS

Signed in

As user A, low privilege

03 · PIVOT

Swapped ID

usr_8420 → usr_8421

04 · IMPACT

Read B’s data

Email, plan, profile

FindingBroken access control
EvidenceRequest + response
After the fixRetest passed
From login to exposure.Illustrative example

How it works

See the agent
at work.

Follow an investigation from the first request to a proven finding — with evidence, remediation guidance, and a retest.

Watch the full demo
Sintropyc / agent
Authorized testIllustrative replay

sintro@audit-lab:~$ Starting authorized test…

Illustrative session: map the application, reproduce an XSS finding in a sandbox, protect captured email and key evidence, review a fix, and retest.

Data protection / before the agent

Keep the context.
Filter the identity.

Sensitive fields are filtered at the boundary before the agent runs. The context stays useful for testing, while personal identifiers and secrets stay out of the agent’s view.

Read our data processing terms
DATA BOUNDARYFilter active
01 / Incoming fields02 / Agent context
Secret•••• •••• ••••
Request contextGET /api/profile
FILTER
Identity filtered<IDENTITY>
Secret filtered<SECRET>
Context retainedGET /api/profile
Filter first. Then analyze.Illustrative example
REDACTION LOGExample replay
Fields filtered1,284
Secrets masked312
Exposed in example0
time · fieldtoken · status
00:06address<IDENTITY>masked
00:05full_name<IDENTITY>masked
00:04session<SECRET>masked
00:03phone<IDENTITY>masked
00:02api_key<SECRET>masked
00:01email<IDENTITY>masked
Checked at the boundary.Illustrative example
What we prove

We prove effect, not reflection

Every class below is judged by real effect — a landing exploit, not a reflection. The set keeps growing.

Vulnerability classes
01 XSS Code executes in the DOM — not merely reflected in the response. DOM exec detected
02 SQL injection Confirmed by a distinguishable effect in the application's response. boolean delta confirmed
03 Command injection Command output visible in the response — a safe echo, nothing destructive. echo marker returned
04 SSRF A canary reaches a controlled channel — the request really left the box. canary received
05 Open redirect Redirection to an external, controlled address. 302 → external host
06 Path traversal A system file is read — confirmed by a content signature. signature matched
07 IDOR / BOLA ★ Our #1 — most found Another account's private record returned — a single changed id is enough. The class we prove most often, on almost every target we run. foreign object read
08 CSRF A state-changing request accepted from an off-site origin. cross-origin write
09 JWT forgery A self-signed token accepted — any session becomes reachable. forged token accepted
10 API keys exposed A live secret reachable from the client — confirmed valid, never printed. key validated
11 NoSQL injection Confirmed by a boolean or timing differential — the query itself changed, not just its input. operator injected
12 SSTI A server-side expression evaluates — e.g. {{7*7}} returns 49, not the literal string. expression evaluated
13 CORS misconfiguration Your origin is reflected with credentials allowed — any site can read the authenticated response. origin reflected
14 Mass assignment A field you never exposed gets written by sending it anyway — role, price, ownership. hidden field written
15 Prototype pollution A crafted key reaches Object.prototype and changes behaviour app-wide. prototype tainted
16 XXE An external entity is resolved by the parser — a local file read or an outbound request. entity resolved
17 Broken authentication No throttling on login or OTP — an attacker can simply keep guessing until one lands. guessed unthrottled
18 Security misconfiguration Missing headers, a verbose stack trace or an open admin path — a door left unlocked, not picked. misconfig confirmed
Browse all 20 vulnerability guides →
Audit engine
Live secret validation

Found a key? One harmless read-only call answers whether it's live or revoked. A test key returns 401 and the false alarm is dropped. The raw key never appears in the report or the logs.

Audit engine
Open database / RLS probe

Supabase / Firebase: we check anonymous access to tables that should not be visible. Row values never leak — we record only the fact of exposure.

See it in action

Watch Sintropyc find, exploit and prove — live.

A short walkthrough of a real engagement: the agent drives the live product, breaks something, and proves the vulnerability with a working exploit — no false alarms.

sintropyc · demo
Pricing

Start with proof.
Build on confidence.

Proof scan is one full test plus one full retest after your fix. Continuous keeps that proof running — full audits on repeat, run by an agent that already knows your business. Either way, you pay for the result: every finding proven.

Proof scan
$1,000 one-off
One full test, plus a full retest after your fix.
  • Proven findings, reviewed by a human
  • Evidence and remediation guidance
  • One full retest after your fix
Everything included
  • ✔Full test — every vulnerability class across your whole site, each one proven with a working exploit
  • ✔Full retest — after your fix we attack again to confirm it's actually closed
  • ✔Full proof report with a verdict on every finding
  • ✔Checked by a human before it reaches you — never sent out unreviewed
  • ✔An exploitation screenshot for every finding
  • ✔Remediation guidance for every finding
  • ✔Static analysis appendix
  • ✔Read-only by default, isolated sandbox
  • ✔Results in a few days, not weeks
  • ✔Support after your report — a direct line to us to ask questions, get help reading a finding, or plan your follow-up test
  • ✔50% off your next scan — run us again after your next release at half price
Run a scan
★ Never goes out of date
Continuous
Custom for teams Monthly plan
Full audits on repeat, run by an agent that already knows your business.
  • Weekly audits and retests
  • Daily checks between audits
  • A custom agent for your business
Everything included
  • ✔Full audit + full retest, every week — the whole Proof scan, run again on your release cadence, not once and forgotten
  • ✔Daily checks between audits — the agent watches your surface as you ship, so new endpoints and new bugs get caught the day they land, not the week
  • ✔A custom agent, tuned to your business — your stack, your auth flows, your data model, not a generic checklist
  • ✔Agent memory that carries over — it remembers your app and every past finding, so each run builds on the last instead of starting cold
  • ✔Blue team support — a direct line to us for hardening advice and help triaging anything the agent surfaces
  • ✔Everything in Proof scan, on every run
  • ✔Priority scheduling and a named engineer
Start continuous
Enterprise
Built around
your team.

A tailored security engagement, working directly with your engineers. Pricing scoped to your needs.

  • Custom scope and reporting
  • Hands-on engineering support
  • A named engineer
Everything included
  • ✔Hands-on work, directly with your team
  • ✔Broader cybersecurity services beyond the standard scan — pentesting, hardening and remediation support
  • ✔Several products under one scope
  • ✔Recurring runs on your release cadence
  • ✔Custom scope, NDA and reporting format
  • ✔A named engineer and priority scheduling
Talk to us
We reply within one business day.
Team

Who builds Sintropyc

DKLinkedIn ↗

Davit K.

Co-founder & CTO

Leads cybersecurity and backend engineering — building the agent, its testing capabilities, and the infrastructure behind Sintropyc.

CybersecurityBackend engineeringAgent architecture
BSLinkedIn ↗

Boro Seyranyan

Co-founder · Marketing, SEO & Web Design

Leads marketing, search visibility, and web design — shaping how people discover Sintropyc and experience the product online.

MarketingSEOWeb design
FAQ

AI pentest, answered

Straight answers on how Sintropyc's autonomous AI penetration testing works, what it costs, and how your data stays safe.

What is an AI pentest, and what is Sintropyc?+
An AI pentest is a penetration test run by an autonomous agent instead of scheduled human consultants. Sintropyc is that agent: it drives your live web app, API or SaaS like a real user, finds vulnerabilities, and proves each one with a working exploit — then advises the exact fix and re-tests that it held.
How much does an AI penetration test cost?+
A Proof scan is $1,000 flat: one full test plus a full retest after your fix. Continuous has custom monthly pricing for teams — weekly full audits, a custom agent tuned to your business, and blue-team support. A traditional manual pentest usually costs $15,000–$30,000 and books weeks out.
How is Sintropyc different from a vulnerability scanner?+
Scanners flag reflections and maybes; Sintropyc proves effect. For every finding it writes and runs a real exploit — code that executes in the DOM, another account's record read, a canary that leaves the box. There are no false alarms, and severity never exceeds what was actually demonstrated.
Which vulnerabilities can Sintropyc find?+
Sintropyc proves 18+ classes, including IDOR and BOLA (its most-found), SQL injection, XSS, SSRF, command injection, SSTI, XXE, JWT forgery, CSRF, path traversal, mass assignment and exposed API keys. Each class is judged by a real, reproducible effect rather than a reflection in the response.
Is it safe to run against a production site?+
Yes. Sintropyc is read-only by default, runs in an isolated sandbox, and uses neutered payloads — a safe echo, never anything destructive. It tests only what you authorise, and a strict data boundary means the AI model never receives your real customer data or live secrets.
How are emails and API keys protected?+
Sensitive evidence is encrypted at rest with AES-256-GCM. Before evidence reaches the agent, detected email addresses and API keys are replaced with typed markers. Encryption protects the stored original; redaction removes sensitive values from the agent view.
Do you retest after we ship the fix?+
Always. Every engagement includes a full retest: we run the same attack after your change to confirm it now fails. Continuous customers get that loop weekly, with lighter checks daily in between, so a new endpoint or a regression is caught the week it lands.
How fast do we get results?+
Days, not weeks. You receive a full proof report with a verdict on every finding, an exploitation screenshot for each, remediation guidance and a static-analysis appendix — all human-reviewed before it reaches you, never sent out unchecked.