What is Agent-as-a-Service pentesting?

Agent-as-a-Service (AaaS) pentesting lets you chat with autonomous pentesting agents that scan your application on demand. Instead of waiting weeks for a manual engagement, you talk to specialized agents — pen-scout (recon and surface mapping), pen-recon (deeper enumeration), pen-triage (validates and prioritizes findings), pen-fixer (remediation guidance), and pen-compliance (OWASP/standards mapping). Findings are validated with proof-of-concept and re-test, not just flagged. You start with 150 free credits, no credit card.

What are credits and how do they work?

Credits are how you run agent scans. Each scan or agent action consumes credits based on its depth. New accounts get 150 free credits with no card required. After that you can buy one-time credit packs ($29, $79, or $199) for pay-as-you-go use, or subscribe to a monthly tier ($49, $149, or $399/mo) for continuous, on-demand pentesting. The agents pen-scout, pen-recon, pen-triage, pen-fixer and pen-compliance all draw from the same credit balance.

Yes. Every new account gets 150 free credits with no credit card required — enough to chat with the pentesting agents and run real scans against your app. There is also a free security headers scan at sable.somoswilab.com/free-scan and a sample report at sable.somoswilab.com/sample-report. The free tier runs on OpenRouter models so you can evaluate the autonomous agents before paying.

What is penetration testing for startups?

Penetration testing (pentesting) is a simulated cyberattack against your application to find security vulnerabilities before real attackers do. For startups, we focus on the issues that matter most at your stage: authentication flaws, data exposure, API security, and common mistakes in modern stacks like Next.js, Supabase, and Firebase.

How much does a pentest cost?

Traditional pentests cost $10,000-$50,000+. SableOffensive starts at $29 for a Pre-Launch Check covering OWASP Top 10 and secrets detection. Founder Shield ($79) adds IDOR testing, auth bypass, and a debrief call. Scale Secure ($199) is a full-scope assessment. Every plan includes a professional report with remediation steps.

How long does a security scan take?

Pre-Launch Check reports are delivered within 24-48 hours. Founder Shield and Scale Secure may take 2-3 business days depending on the complexity of your application.

What do I need to provide?

At minimum, just your application URL. For more comprehensive testing, we may ask for staging credentials, API documentation, or GitHub repository access. We sign NDAs for all engagements.

What is OWASP Top 10?

OWASP Top 10 is the industry standard list of the most critical web application security risks. It includes injection attacks, broken authentication, cross-site scripting (XSS), server-side request forgery (SSRF), and security misconfigurations. Every SableOffensive assessment tests against the full OWASP Top 10.

Do you test AI-generated code?

Yes. Code generated by AI tools like Cursor, GitHub Copilot, and v0 often contains subtle security issues: hardcoded secrets, missing input validation, insecure API patterns, and overly permissive access controls. We have specific testing procedures for AI-generated codebases.

How do you secure Supabase and Firebase apps?

For Supabase, we audit Row Level Security (RLS) policies, test for direct table access, and check for exposed service keys. For Firebase, we review security rules, test Firestore/RTDB access patterns, and check Cloud Functions for vulnerabilities.

What if you find zero vulnerabilities?

50% money back guarantee. If our scan finds zero security issues, you get half your money back.

Is there a free pentesting option?

Yes. SableOffensive offers a free security headers scan at sable.somoswilab.com/free-scan. It instantly checks your website for 8 critical security headers (HSTS, CSP, X-Frame-Options, and more) and gives you an A-F grade with copy-paste fixes. No signup or payment required.

Can I get a free vulnerability scan?

Our free security headers check scans your website instantly and grades your security posture. For a deeper free assessment, contact us — we occasionally offer complimentary scans for early-stage startups and open source projects.

Ubiquiti UniFi Connect suffers critical CVE-2026-50746 command injection flaw

What Happened

Ubiquiti released emergency updates for its UniFi ecosystem, fixing a maximum‑severity command injection vulnerability (CVE-2026-50746) in the UniFi Connect application. The flaw allows an unauthenticated attacker on the same network to execute arbitrary commands on the host device, earning a CVSS score of 10.0. The Hacker News and BleepingComputer confirmed the issue and the immediate patch release.

Technical Analysis

The vulnerability resides in an improper access‑control check within the UniFi Connect application (versions ≤ 3.4.16). When an attacker can reach the service over the network, they can craft a request that bypasses authentication and triggers a command‑injection routine, executing shell commands on the underlying host. The CVE is listed as CVE‑2026‑50746 with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The advisory recommends upgrading to UniFi Connect 3.4.20 or later, which contains the fix. SOCRadar provides the detailed CVSS vector and remediation steps.

Alongside CVE‑2026‑50746, Ubiquiti disclosed six additional high‑severity flaws: CVE‑2026‑50747 (SQL injection in UniFi Talk, CVSS 9.9), CVE‑2026‑50748 (input validation in UniFi Access, CVSS 9.9), CVE‑2026‑54400 (access‑control in UniFi Access, CVSS 9.1), CVE‑2026‑55115 (SSRF in UniFi Protect, CVSS 9.9), CVE‑2026‑54402 (input validation in UniFi OS, CVSS 9.9) and CVE‑2026‑55116 (access‑control in UniFi OS, CVSS 9.0). All were addressed in the same patch cycle. The Hacker News lists these alongside the primary CVE.

Who’s Affected

The bug affects any deployment of UniFi Connect version 3.4.16 or earlier, which includes many on‑premise installations of UniFi controllers, UDM/UDM‑Pro appliances, and cloud‑managed UniFi sites. According to Censys, over 100 000 UniFi OS instances are publicly reachable, with roughly half located in the United States. While there is no public evidence of wild exploitation yet, the severity and network‑local attack surface make immediate remediation critical for enterprises and MSPs that manage large numbers of UniFi devices.

How to Protect Yourself

Upgrade UniFi Connect to version 3.4.20 or later immediately. The update is available through the UniFi Network controller UI or via the Ubiquiti firmware repository.
Apply the same patch level to all other UniFi components (Talk 5.2.2, Access 4.2.29, Protect 7.1.83, OS 5.1.19) to close the related CVEs.
Restrict network access to UniFi management interfaces. Use firewall rules or VLAN segmentation to limit exposure to trusted subnets only.
Enable two‑factor authentication on UniFi accounts and enforce strong passwords to mitigate credential‑theft attempts.
Conduct a rapid vulnerability scan of your environment to confirm no lingering instances of the vulnerable versions remain.

The Sable Angle

At Sable we routinely audit network‑management stacks for exactly these kinds of supply‑chain flaws. Our recent research on IoT‑focused attack surfaces highlighted how a single compromised controller can give attackers full visibility into a corporate LAN. By integrating continuous monitoring of UniFi endpoints into our automated security platform, we can detect outdated firmware before it becomes a leverage point. Learn more about our approach in the OpenClaw research series and see how our managed detection service can keep your infrastructure patched in real time.