Find the security holes in your app before hackers do.

Founder CVE: CVE-2026-24763 · CVSS 8.8

Point Sable at your site. Autonomous agents scan it like a real attacker would, then hand you the exact bugs, and the code to fix them. Built for founders and solo devs, not enterprise security teams.

Free security header check— results in seconds, no signup

Reads HTTP response headers only — no invasive scanning.

Start free, 150 credits

No site to scan yet? Start free — no credit card.

Real finding · redactedCRITICAL · CVSS 9.1
Broken access control (IDOR): any logged-in user could read every other user's profile.
▸ GET /api/users/{id} → change the id, get someone else's data
See the full report
Founder CVE: CVE-2026-24763 · CVSS 8.8Five specialist agents · isolated infraOWASP Top 10PoC repo per finding
pen-scoutLIVE
Scope · engagement plan
Reads the target. Writes the rules of engagement.
▸ mapping attack surface · 4 endpoints found
pen-reconLIVE
External recon · subdomain mapping
Enumerates surface. Flags staging envs.
▸ 3 subdomains · 1 staging exposed.
pen-triageIDLE
Scanner output · false-positive cull
Reads Nuclei, ZAP, semgrep. Keeps the real ones.
▸ awaiting scan output
pen-fixerIDLE
Diff-grade remediations
Writes the patch. Cites the disclosure.
▸ idle
pen-complianceQUEUED
SOC2 · ISO27001 evidence pack
Renders findings into auditor-ready PDFs.
▸ queued · 1 job
api/user/[id]/route.tsBOLA · critical
// AI-generated handler, no ownership check
const user = await db.user.findFirst({
  where: { id: req.params.id },
});

// pen-triage would add:
//   where: { id: req.params.id, ownerId: session.uid }
//   ↑ one predicate. every record stays private.
THE PROBLEM

AI-generated code ships fast. It also ships the bugs.

Cursor, v0, Bolt, Lovable generate functional code in seconds. They do not sanitize inputs, validate tokens, or check authorization. Your AI assistant is an intern who ships to production.

45%AI code · OWASP Top 10 vuln40%Copilot code · vulnerableMissing authorization checks

Sources: Veracode 2025 GenAI Code Security Report (45% of AI-generated samples across 100+ LLMs introduced OWASP Top 10 flaws) · Pearce et al., “Asleep at the Keyboard,” IEEE S&P 2022 (~40% of 1,689 GitHub Copilot programs vulnerable).

What we see, every week

A query missing a single ownership check, and every user becomes admin.

Broken access control (BOLA/IDOR) is the #1 category in the OWASP Top 10. It lands in shipped code because the LLM completed the query, then skipped the predicate that proves the caller owns the row.

Five agents. One console.

Each agent is a narrow operator. Scout writes the plan; the others execute. You chat, they run real tools.

Meet the agents
pen-scoutLive

Scope & engagement plan

Maps your attack surface, writes the engagement plan, and tells you what NOT to scope. Start every job here.

4 credits / turn
pen-reconLive

External recon

Subdomain enumeration, exposed staging envs, leaked secrets, third-party drift. Hands findings to triage.

6 credits / turn
pen-triageIdle

Finding explainer

Reads scanner output. Tells you what is real, what is noise, and what would actually hurt in production.

5 credits / turn
pen-fixerIdle

Remediation walkthroughs

Code-level fixes for OWASP findings: Supabase RLS, Next.js routes, auth flows. Diffs you can paste.

7 credits / turn
pen-complianceQueued

Audit & compliance

Maps findings to OWASP, PCI-DSS, SOC 2 controls. Generates the evidence pack your auditor asks for.

5 credits / turn
Free
Step 01 — Sign up, 150 free credits
Five specialists
Step 02 — Pick an agent
From $29
Step 03 — Need depth? Run a scan.

Three steps. No onboarding call.

From signup to a scoped pentest in under five minutes. Everything runs in your browser; everything bills by the credit.

01

Sign up, 150 free credits

No card. Magic-link auth. You land in the console with Scout already waiting.

02

Pick an agent

Scout writes the engagement plan. Recon maps the surface. Triage reads scanner output. Fixer ships diffs. Compliance preps your evidence pack.

03

Need depth? Run a scan.

When chat hits its limit, hand off to a one-time pentest ($29, $79, or $199) without leaving the thread.

Start free
REAL OPS

We ship the work the agents also do.

No fabricated logos. Three real artifacts — read the full write-up or check the source yourself before you spend a credit.

CVE-2026-22778

vLLM remote code execution

Discovered by Orca Security, published to NVD. Our exposure research on it followed the same recon-to-PoC workflow pen-scout walks customers through.

Read the write-up
sable · research
$ curl -s https://services.nvd.nist.gov/rest/json/cves/2.0 \
  ?cveId=CVE-2026-22778 | jq .vulnerabilities[0]
{
  "cvssV3": 9.8,
  "severity": "CRITICAL",
  "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
OpenClaw / Moltbot

Three CVEs in AI gateway agents

Same agents now powering pen-fixer remediations. The fix patterns shipped here come from the actual disclosure write-ups, not blog summaries.

Read the write-up
sable · research
$ git log --grep="CVE" --oneline -3
a7c91f2  fix: bound prompt-injection in agent router
d23b40e  fix: SSRF in moltbot fetch tool
88e1c0a  fix: path-traversal in openclaw state dir
# 3 CVEs · all patched · disclosed responsibly
AEGIS

Open-source SOAR + XDR + deception

The tooling pen-recon and pen-triage delegate to. Maintained in public; bugs filed there fix the console experience next.

Verify on github.com
github.com
$ aegis --status
soar:        running   (12 playbooks)
xdr:         running   (4 sensors)
deception:   running   (3 honeypots)
# open-source · github.com/AEGIS

Latest research

Practical security writing for founders shipping fast: the bugs AI assistants ship, what a pentest actually finds, and how to decide what your launch needs.

View all posts

Pay only what you use. No seats. No contracts.

Credits power agent turns. Scoping and recon questions cost 1 each; triage, patch review and compliance evidence cost 5. Your 150 signup credits go a long way. Top up when you need.

Need a one-time pentest instead?

Skip the chat. Fixed scope, fixed price, PDF in 24-48h. Pick a tier below.

What credits buy

Every agent turn, itemised

Scope conversation
1 credit
Recon question
1 credit
Findings triage
5 credits
Patch review
5 credits
Compliance evidence
5 credits
150 free credits on signup, no card required
$9USD
100 credits · $0.09 / credit

Try the console. 20-ish agent turns. No card to start, 150 free credits on signup.

Top up
most picked
$29USD
500 credits · $0.058 / credit

A real engagement: scope, recon, triage, fixes. The pack most operators land on.

Top up
$99USD
2000 credits · $0.0495 / credit

Multi-app coverage or a quarter of triage work. Hands back to scans when depth is needed.

Top up

Fixed scope. Fixed price.

No enterprise pricing. No monthly fees. One scan, one PDF, PoC repos included.

Secure checkout · USD · No subscription

Every plan includes

  • Security Headers
  • Secrets Detection
  • CORS Check
  • Basic OWASP

Pre-Launch Check

Perfect for MVPs and landing pages

$39$29USD

Landing pages, portfolios, simple MVPs

  • Security headers analysis
  • Exposed secrets detection
  • CORS misconfiguration check
  • Basic OWASP coverage
  • PDF report in 24-48h
  • Email support
Most picked

Founder Shield

For SaaS with user data

$99$79USD

SaaS apps, user auth, payment flows

  • Everything in Pre-Launch Check
  • BOLA / IDOR vulnerability testing
  • API endpoint discovery
  • Authentication flow analysis
  • Full OWASP Top 10 coverage
  • 30-min consultation call
  • Priority support

Scale Secure

Complete security assessment

$299$199USD

Funded startups, enterprise clients

  • Everything in Founder Shield
  • SQLi & XSS deep testing
  • Infrastructure scanning
  • Compliance report (OWASP, PCI)
  • Re-test after fixes included
  • Slack/Discord support channel
  • Security badge for your site

Traditional pentesting firms charge $10,000 to $50,000+ for the same coverage.

Compare plans

Pre-Launch

Security Headers
Secrets Detection
CORS Check
Basic OWASP
Full OWASP Top 10
BOLA / IDOR Testing
API Discovery
Auth Flow Analysis
SQLi & XSS Deep Test
Infrastructure Scan
Consultation Call
Re-test After Fixes
Compliance Report
Delivery Time
24-48h

Founder Shield

Security Headers
Secrets Detection
CORS Check
Basic OWASP
Full OWASP Top 10
BOLA / IDOR Testing
API Discovery
Auth Flow Analysis
SQLi & XSS Deep Test
Infrastructure Scan
Consultation Call
30 min
Re-test After Fixes
Compliance Report
Delivery Time
2-3 days

Scale Secure

Security Headers
Secrets Detection
CORS Check
Basic OWASP
Full OWASP Top 10
BOLA / IDOR Testing
API Discovery
Auth Flow Analysis
SQLi & XSS Deep Test
Infrastructure Scan
Consultation Call
60 min
Re-test After Fixes
Compliance Report
Delivery Time
3-5 days
50% money back if we find zero issues

Reports include compliance mapping for

OWASPPCI-DSSHIPAAGDPRSOC 2

Continuous monitoring, billed monthly.

One-time scans catch today's issues. Continuous plans keep watching, with automated re-scans, alerts, and reporting every month. Billed immediately, cancel anytime.

24/7 monitoring
Auto re-scan
Instant alerts
Always covered
Prefer a one-time scan instead?

Scan cadence by tier

Starter
Weekly automated scans
Pro
Daily automated scans
Enterprise
Continuous 24/7 scanning

Starter

Essential monitoring for small projects

$49/moUSD

Billed monthly · cancel anytime

  • Weekly automated scans
  • 1 domain included
  • Email alerts
  • OWASP Top 10 coverage
  • Monthly security report
Most popular

Pro

Complete protection for growing startups

$149/moUSD

Billed monthly · cancel anytime

  • Daily automated scans
  • 3 domains included
  • Slack & Discord alerts
  • Full vulnerability coverage
  • Real-time dashboard
  • API endpoint monitoring
  • Compliance tracking

Enterprise

Maximum security for scale-ups

$399/moUSD

Billed monthly · cancel anytime

  • Continuous 24/7 scanning
  • Unlimited domains
  • All alert channels + PagerDuty
  • Advanced threat detection
  • Custom dashboard & reports
  • Dedicated response team
  • API access + custom integrations
Cancel anytime. No long-term contracts, no setup fees.

Real startups. Real vulnerabilities.

Anonymized findings from real security assessments. No brand names, just stacks, vulnerabilities, and outcomes.

Mobile App Backend
Node.js + Custom Server
24h delivery
9.2/10
Risk score
2Critical
3High
4Medium

Social Media Startup

Server fully compromised: unauthorized access confirmed
Real IP exposed behind CDN, bypassing DDoS protection
Directory listing enabled: source code and configs accessible
Report delivered in 24h. Critical infrastructure rebuilt from scratch.
SaaS Platform
Next.js + Supabase
24h delivery
7.2/10
Risk score
4High
5Medium

EdTech Startup

SSRF vulnerability via known CVE: internal network access possible
Server IP exposed through DNS misconfiguration
Insecure cookies and missing HSTS headers
All high-severity issues patched within 72 hours.
Desktop App + Landing
React + Discord + Electron
24h delivery
7.8/10
Risk score
1Critical
1High
2Medium

AI Startup

Discord webhook token exposed in client code: full channel takeover
Hardcoded API credentials in desktop app bundle
Missing Content Security Policy on landing page
Webhook rotated and secrets moved to backend within 24 hours.
Online Raffle Platform
Next.js + Supabase + Stripe
24h delivery
5.5/10
Risk score
1High
4Medium

E-commerce Startup

TLS 1.0/1.1 still enabled: vulnerable to downgrade attacks
Supabase project URL disclosed in client-side code
Missing CSP allows potential XSS exploitation
TLS hardened and security headers implemented same week.
Exam Certification App
React + Vercel + REST API
48h delivery
6.4/10
Risk score
3High
4Medium

EdTech Platform

11 vulnerabilities found across web app and API
Sensitive exam data accessible through API enumeration
Missing rate limiting on authentication endpoints
Full remediation completed before platform launch.
Corporate Website
WordPress + Custom Plugins
24h delivery
5.8/10
Risk score
2High
3Medium

Industrial Tech

Outdated WordPress plugins with known CVEs
Admin login page exposed without brute-force protection
Sensitive internal paths disclosed via error pages
Plugins updated, WAF configured, admin hardened.

A reproducible PoC for every finding · all anonymized · stacks & findings only

Autonomous + researcher-grade.

Most security tools force a tradeoff: speed (AI scanners) or depth (traditional firms). Sable runs both: autonomous scans on isolated Kali, then validated by humans who file CVEs.

Comparison data from public pricing pages and standard SaaS pentest deliverables · Q2 2026

Capability
Sable
Traditional firms
AI-only scanners
Delivery time
24-48h
2-4 weeks
Continuous
Starting price
$29
$10,000+
Free to $200/mo
OWASP Top 10 coverage
Manual validation
AI-code / LLM app audit
Rare
Limited
Startup-stack specialization
Supabase · Next.js · Vercel
Generic
Generic
Published CVEs
3
Varies
None
Fix guidance in report
Code-level
High-level
Generic
Money-back guarantee
50% if no findings

Free: Startup security checklist

15-point checklist covering the most common security mistakes in AI-built MVPs.

No spam. PDF downloads instantly when you submit.

sable-startup-security-checklist.pdf

15 points · one page

Questions, answered.

Everything founders ask before their first scan: is it safe, do I need to be technical, what do I get, and how the free credits work.

Still have questions?

Contact us at [email protected]