What is Agent-as-a-Service pentesting?

Agent-as-a-Service (AaaS) pentesting lets you chat with autonomous pentesting agents that scan your application on demand. Instead of waiting weeks for a manual engagement, you talk to specialized agents — pen-scout (recon and surface mapping), pen-recon (deeper enumeration), pen-triage (validates and prioritizes findings), pen-fixer (remediation guidance), and pen-compliance (OWASP/standards mapping). Findings are validated with proof-of-concept and re-test, not just flagged. You start with 150 free credits, no credit card.

What are credits and how do they work?

Credits are how you run agent scans. Each scan or agent action consumes credits based on its depth. New accounts get 150 free credits with no card required. After that you can buy one-time credit packs ($29, $79, or $199) for pay-as-you-go use, or subscribe to a monthly tier ($49, $149, or $399/mo) for continuous, on-demand pentesting. The agents pen-scout, pen-recon, pen-triage, pen-fixer and pen-compliance all draw from the same credit balance.

Yes. Every new account gets 150 free credits with no credit card required — enough to chat with the pentesting agents and run real scans against your app. There is also a free security headers scan at sable.somoswilab.com/free-scan and a sample report at sable.somoswilab.com/sample-report. The free tier runs on OpenRouter models so you can evaluate the autonomous agents before paying.

What is penetration testing for startups?

Penetration testing (pentesting) is a simulated cyberattack against your application to find security vulnerabilities before real attackers do. For startups, we focus on the issues that matter most at your stage: authentication flaws, data exposure, API security, and common mistakes in modern stacks like Next.js, Supabase, and Firebase.

How much does a pentest cost?

Traditional pentests cost $10,000-$50,000+. SableOffensive starts at $29 for a Pre-Launch Check covering OWASP Top 10 and secrets detection. Founder Shield ($79) adds IDOR testing, auth bypass, and a debrief call. Scale Secure ($199) is a full-scope assessment. Every plan includes a professional report with remediation steps.

How long does a security scan take?

Pre-Launch Check reports are delivered within 24-48 hours. Founder Shield and Scale Secure may take 2-3 business days depending on the complexity of your application.

What do I need to provide?

At minimum, just your application URL. For more comprehensive testing, we may ask for staging credentials, API documentation, or GitHub repository access. We sign NDAs for all engagements.

What is OWASP Top 10?

OWASP Top 10 is the industry standard list of the most critical web application security risks. It includes injection attacks, broken authentication, cross-site scripting (XSS), server-side request forgery (SSRF), and security misconfigurations. Every SableOffensive assessment tests against the full OWASP Top 10.

Do you test AI-generated code?

Yes. Code generated by AI tools like Cursor, GitHub Copilot, and v0 often contains subtle security issues: hardcoded secrets, missing input validation, insecure API patterns, and overly permissive access controls. We have specific testing procedures for AI-generated codebases.

How do you secure Supabase and Firebase apps?

For Supabase, we audit Row Level Security (RLS) policies, test for direct table access, and check for exposed service keys. For Firebase, we review security rules, test Firestore/RTDB access patterns, and check Cloud Functions for vulnerabilities.

What if you find zero vulnerabilities?

50% money back guarantee. If our scan finds zero security issues, you get half your money back.

Is there a free pentesting option?

Yes. SableOffensive offers a free security headers scan at sable.somoswilab.com/free-scan. It instantly checks your website for 8 critical security headers (HSTS, CSP, X-Frame-Options, and more) and gives you an A-F grade with copy-paste fixes. No signup or payment required.

Can I get a free vulnerability scan?

Our free security headers check scans your website instantly and grades your security posture. For a deeper free assessment, contact us — we occasionally offer complimentary scans for early-stage startups and open source projects.

Free Security Scan for Supabase Apps — Find Real Vulnerabilities | SableOffensive

Why Supabase Apps Get Hacked

Supabase is fast to ship on because the database is reachable directly from the client — which is also its single biggest risk. If Row Level Security is off or misconfigured, the anon key lets anyone read or write your tables. And if the service-role key (which bypasses RLS entirely) ever reaches the browser, the whole database is exposed. We scan for the Supabase-specific failure modes that cause real breaches.

Common Supabase Vulnerabilities

Disabled or weak RLS

Row Level Security off, or policies that effectively allow all rows, means the public anon key can read and modify every record. This is the #1 Supabase breach cause.

Service-role key in the client

The service_role key bypasses RLS completely. If it is in a NEXT_PUBLIC_ var, frontend code, or a leaked .env, an attacker owns your entire database.

Over-permissive policies

Policies that check authentication but not ownership (USING (true) or missing auth.uid() = user_id) let any logged-in user read every other user's data.

Exposed Storage buckets

Public buckets or missing storage policies expose uploaded files — invoices, IDs, private media — to anyone with the URL pattern.

Unprotected Edge Functions / RPC

Postgres functions and Edge Functions exposed without authorization checks or rate limits become a direct path to data and abuse.

What the Sable Scan Checks

Exposed secrets & API keys

We scan your client-side bundles and responses for leaked API keys, tokens, database URLs, and 100+ secret patterns that ship to the browser by accident.

Security headers & TLS

HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and TLS protocol/cipher configuration — graded A-F with copy-paste fixes.

CORS & access control

Overly permissive CORS, wildcard origins with credentials, and broken object-level authorization (IDOR/BOLA) where one user can reach another user's data.

Injection & API surface

SQL/NoSQL injection, exposed OpenAPI/Swagger specs, GraphQL introspection, mass assignment, missing rate limits, and excessive data exposure.

OWASP Top 10 coverage

Autonomous pentesting agents test against the full OWASP Top 10 2025, validate each finding with a proof-of-concept, and re-test after you fix.

Validated findings, not noise

Every reported issue is confirmed by an agent before it reaches you — so you get real, exploitable findings with severity and remediation, not scanner spam.

Scan Your Supabase App in Minutes

Create a free account, point the agents at your app, and get validated findings with proof-of-concept and fix guidance. 150 founder credits, no credit card.

Get 150 Free Credits

Frequently Asked Questions

How do I know if my Supabase RLS is configured correctly?

Test it from the client with only the anon key: try to read and write rows you should not be able to. If RLS is off or a policy uses USING (true), you will succeed — which means anyone can. Sable probes your tables and storage with the public key and reports exactly what is reachable.

What happens if my Supabase service-role key leaks?

The service-role key bypasses all Row Level Security, so a leak means full read/write access to your entire database. Rotate it immediately, keep it server-only, and never put it in a NEXT_PUBLIC_ variable. Sable scans your client bundle for exposed Supabase keys.

Is the security scan really free?

Yes. The Headers Scan runs instantly with no signup. For the full agent scan you create a free account and get 150 founder credits with no credit card required — enough to run real scans against your app on demand. Paid credit packs and monthly tiers exist for continuous testing, but you can start for free.

How does Sable scan my app?

Sable runs autonomous pentesting agents (pen-scout, pen-recon, pen-triage, pen-fixer, pen-compliance) that map your attack surface, test against the OWASP Top 10, validate every finding with a proof-of-concept, and re-test after you ship a fix. You chat with the agents on demand instead of waiting weeks for a manual engagement.

Will the scan break or slow down my production app?

No. Scans are designed to be safe and non-destructive. We demonstrate impact with proof-of-concept evidence rather than causing damage, and we never exfiltrate or alter your data.

Security Scans for Other Stacks

Next.js React Vue Vercel Node.js Express