A pentest for your app that proves every finding.
We have completed our pilots — finding critical vulnerabilities on real applications — and we are now taking on customers. SuperPentest runs an autonomous AI pentest inside a scope you authorize, and reproduces every finding from a clean session before reporting it. We don't tell you. We prove it.
The short version: an autonomous AI pentest for one application or API you authorize — access control, business logic, API and AI-agent security, with every finding reproduced from a clean session before it reaches you. First results within 48 hours.
How it works
SuperPentest is an autonomous AI pentest for web applications, APIs and the AI agents inside a product. You authorize one application and hand over a test account per role; the engine maps the attack surface, tests real authorization boundaries as each identity, and proves every finding before it is reported — so there is nothing to triage and no argument about whether it is real.
What the assessment covers
- One authorized application or API. The attack surface is mapped and tested as each role identity you supply.
- Access control (IDOR/BOLA) — the same request replayed as every identity and compared to the rule. method →
- Business logic — abuse of the rules specific to your application. method →
- AI agent security — prompt injection (proven with a canary), tool-call boundaries, MCP. more →
- Proof — every finding reproduced from a clean session before reporting, with request/response evidence and a fix direction.
How to start
- 1. Book a scoping call. We agree the scope and your objective together.
- 2. Verify ownership and add a test account per role.
- 3. Approve the scope — tests only ever run inside an authorized, written scope.
- 4. Review the results — first findings within 48 hours, with the evidence attached.
Why reproduction
Our brand rests on one promise: find every vulnerability, prove every one. Every finding is reproduced from a clean session before it reaches you — first a control to show the boundary exists, then a fresh break-in, three times over. Anything that cannot be repeated is dropped rather than reported, which is why there is nothing to triage and no scanner noise to argue about.
FAQ
How do I start?
Book a scoping call. We agree the scope together, you verify ownership and add a test account per role, and the engine takes it from there. Tests only ever run inside an authorized, written scope.
What does it cover?
One authorized application/API: access control, business logic, injection, API security and — if present — AI agents. Every finding is reproduced from a clean session.
Is my data safe?
Tests run only inside an authorized, written scope, captured traffic is redacted before storage, and our infrastructure is EU-hosted (Frankfurt). Data Processing Agreement →
Book a scoping call
We agree the scope and your test identities on the call; first findings arrive within 48 hours of authorization. Authorized targets only.