One web application and its API, tested by a human researcher against a scope you approve. A reviewer checks every finding before it is published to you.
Quotation after scope review. No call required.
finding · sample
Object access on GET /orders/{id}
A normal account can request another customer’s order by changing the identifier. Severity is high after review. This panel is a layout sample.
A person checks the evidence. A scanner alert is not copied into your report.
Scope and review
Hosts, roles, and exclusions are named before active testing starts.
# sample finding
title: object access
severity: high
status: published
source: reviewer
scanner_alert: withheld
Evidence
Request, response, and the affected endpoint.
GET /orders/{id}
Severity high · after review
Review
Impact and severity are checked before publication.
Reviewed
before you see it
Held
if evidence is thin
Report
Scope, limitations, findings, and remediation.
A finding with reproduction, impact, and a remediation note. Not a compliance certificate.
Not a bug bounty, not a scanner subscription, and not SOC 2 or ISO 27001.
Production is in scope only when you authorise it.
Destructive and availability tests stay out.
Currency is a setting on the quotation.
Included only when the accepted package says so.
Testing starts after the rules of engagement, not at form submit.
Pick a step. The panel shows what is in the engagement and what is held back.
In the scope
The scope you approve
One web application, its API, and the roles in the rules of engagement. Anything else stays out.
Held back
Not published as fact
Scanner output and certificates stay off the report.
Choose the shape of the scope. The amount is issued after review, in INR or USD.
Web + API
The fee is written on the quotation after scope review.
Clear answers. No call is required to ask them.
No. You can request the assessment, answer scope questions, accept the quotation, and follow the project in writing. A call is optional if you later ask for one.
The application URL, the API type, how users sign in, the roles to compare, and whether the target is staging or production. OpenAPI or Postman files help. Do not send passwords or production secrets on the form.
After the scope is approved, you accept the quotation, and you sign the rules of engagement. Submitting this form does not start a test. Paying an invoice does not start a test.
No. The report describes what was tested, what was found, and what was out of scope. It is not a SOC 2 report, an ISO 27001 certificate, or an approval from an auditor.
Only when production is named in the authorised scope. Staging is the better default. Destructive tests and denial-of-service tests are out of scope.
A researcher invited to that project. ScnFix reviews the findings before you see them. We do not publish a researcher count, and there is no public signup or bidding.
Share the application and the reason. We reply in writing. No call is required.