Pentest — automated active security testing

Vibe Check tells you what's visible from the outside. Pentest actively verifies whether it can really be exploited — dozens of probes from open redirect to SQL injection and AI-native attacks. Requires target ownership verification (a DNS TXT record or verification file) and explicit consent before every run.

How it differs from the Vibe Check scan

Vibe Check is passive: it only reads what's publicly visible and never actively tries anything. Pentest actively attempts exploitation — a test payload, a default password, bypassing an IDOR — which is why it only runs against your own verified domain.

Authorization and scope

Ownership of the target is verified before the first run, and explicit consent (time and IP) is logged on every run. It cannot be run against government and critical-infrastructure domains, local/private IP ranges, or domains requiring authentication. For sensitive files (.env, .git) the report shows only a confirmation of the finding, never its content.

Status: closed beta

Pentest is currently available to the admin team and allowlisted testers, without a standalone self-serve purchase yet. Interested users can sign up via the contact form.