Test it. Publish what you find.
We would rather you tested SuperPentest than took our word for it. If you are a security researcher, we will give you free access to run it against your own targets — and we want you to publish whatever you find, good or bad. We are not asking for a positive review. We are asking for an honest, reproducible one.
The short version: free access for security researchers, no positive-review strings attached. Point it at a target you are authorized to test, measure it however you like — recall, false positives, reproduction, business logic, AI-agent attacks — and publish your results. We will link honest write-ups whether they flatter us or not. Evidence-first cuts both ways.
The offer
- Free evaluation access to run SuperPentest against targets you are authorized to test (your own apps, intentionally vulnerable labs, or an agreed scope).
- No NDA on your findings about the tool. Review it in public. Compare it to anything.
- Our benchmark corpus and methodology are open if you want a level playing field — run us and others on the same targets. See the benchmark.
- Direct access to the founder for questions, and fast answers on how the engine reaches a result.
The only rules
- Stay in scope. Only test targets you own or are authorized to test. We will not provision access to attack third parties — that is the whole point of the product.
- Be honest. Publish what actually happened, including where it fell short. A review we had to approve would be worthless to everyone.
- Be reproducible. Show enough that a reader could repeat it. That is the standard we hold our own findings to.
That is it. No required rating, no approval step, no embargo on criticism.
What you might test
- Recall and false positives on a target with known bugs — how much does it find, how much does it make up?
- Access control — can it prove a cross-tenant BOLA/IDOR, with the control/test pair? our method →
- Business logic — the flaws a scanner cannot reach. more →
- AI-agent attacks — can it prove an indirect prompt injection with a canary, or test an MCP server? the canary method →
- Reproduction — do its findings hold up when you re-run them from a clean state?
- Head-to-head — run it against another tool on the same target and publish the table.
Why we do this
Our brand is one promise: find every vulnerability, prove every one. A marketing page cannot establish that — only independent testing can. Five honest, reproducible reviews from researchers are worth more than anything we could write about ourselves, and if the tool is as good as we think, the way to show it is to let people check. If it is not, we would rather hear it from you than from a customer.
Get access
Email [email protected] with [researcher] in the subject and a line about what you would like to test. Include a link to prior work if you have it. We reply to these ourselves, usually within a couple of days.
Already testing? Send us the write-up when it is live — we will link honest reviews whatever they conclude. Start with the open benchmark or a worked finding.