MyPentest
Automated penetration testing
Maps your web app's attack surface, then tests it: exposed secrets, broken access control, injection, session flaws and known vulnerabilities, with evidence, CVSS scores and fixes.
Penetration testing · automated and expert-led
Security testing that actually tests.
BugSnaps finds the vulnerabilities an attacker would use - with MyPentest, our automated penetration test, and with our testers when you need a human on it.
Need a manual engagement? Book a security consultation
Free plan · No credit card · Only tests domains you prove you own
mypentest · demo.vulnerable-app.testReplay
- Verify
- Map
- Test
- Report
- Paths mapped
- 21
- Requests
- 1,741
- Findings
- 194
- Leaked keys and secrets
- CWE-798
- CWE-312
- Broken access control
- CWE-639
- OWASP A01
- Injection
- CWE-89
- CWE-78
- CWE-79
- Sessions and tokens
- CWE-922
- CWE-347
- Hidden API surface
- OpenAPI
- GraphQL
- WebSocket
- Configuration and known CVEs
- CVSS 3.1
- CISA KEV
- EPSS
How a scan runs
From a domain to a fix list, in four phases.
Nothing is sent to your site until ownership is proved, and nothing on it is changed.
01 · Verify
Prove you own it.
Publish one DNS TXT record. The value is tied to your account, so nobody else can use it.
phase 01 / 04 · verify── verify demo.vulnerable-app.test
› looking up the DNS TXT record
✓ record matches this account · ownership verified
› scope locked to demo.vulnerable-app.test
Example output · our deliberately vulnerable test app
02 · Map
Map the attack surface.
The crawler maps pages, forms, APIs, JavaScript-referenced endpoints and login surfaces - within your scope only.
phase 02 / 04 · map── map
› crawling pages, forms and scripts
› reading JavaScript for API endpoints
› found /api/orders/1
› found /session
› found /static/app.js
› found /.env
✓ 21 paths with results mapped
Example output · our deliberately vulnerable test app
03 · Test
Test it like an attacker would.
Checks run against what was found. Watch progress live; stop at any time. 32 passive checks only read; 24 safe-active checks send harmless probes or sign in as your test accounts.
phase 03 / 04 · test── test
✓ signed in as 3 test accounts
› 56 checks · passive and safe-active
! [critical] Environment file exposed
! [high] Login form submits over plain HTTP
! [medium] One user can read another user's record (IDOR)
Example output · our deliberately vulnerable test app
04 · Report
Get evidence and fixes.
Severity, confidence, evidence and remediation for each issue. Export it, and find it again in your history.
phase 04 / 04 · report── report
✓ 194 findings in 41 groups · 12 critical or high
› CVSS 3.1 · confidence · evidence · fix, for each
› 9 attack paths linked
› exports: JSON · MD · HTML · SARIF · PDF
Example output · our deliberately vulnerable test app
phase 01 / 04 · verify
── verify demo.vulnerable-app.test
› looking up the DNS TXT record
✓ record matches this account · ownership verified
› scope locked to demo.vulnerable-app.test
Example output · our deliberately vulnerable test app
- checks per assessment
- 56
- passive checks that only read
- 32
- safe-active checks
- 24
- export formats, SARIF included
- 5
The report
Findings you can hand straight to engineering.
Grouped findings with severity, CVSS 3.1, how certain each one is, the evidence, and the exact fix - plus attack paths and a remediation plan ranked by fix window.
mypentest · demo.vulnerable-app.testExample
- Verified
- Mapped
- Tested
- Reported
Findings
194 in 41 groups
4 critical · 8 high
- Critical
Environment file exposed
CVSS 9.8 · confirmed · CWE-538
- Critical
Command injection: shell echo output visible from 'host'
CVSS 9.8 · confirmed · CWE-78
- Critical
SQL injection (error-based) in 'q' parameter
CVSS 9.8 · confirmed · CWE-89
- Critical
Server-Side Template Injection in 'name' (Jinja2/Twig)
CVSS 9.8 · confirmed · CWE-1336
Products
Two tools, one security team behind them.
MyRecon
Reconnaissance and OSINT
Username, email and breach intelligence, password-exposure checks, WHOIS, DNS and IP investigation - the reconnaissance layer of the BugSnaps ecosystem.
Free AI Pentesting
Free automated web assessment
Start a defined automated assessment of your verified web application without a credit card. The free plan has scan limits and restricted report visibility.
AI Website Pentesting
Automated website and API assessment
Maps accessible pages, APIs and JavaScript-referenced endpoints. Tests supplied account access and reports defined security checks with evidence and confidence.
AI Pentesting Guide
Compare automation by scope and evidence
Learn what to evaluate in AI penetration testing and automated security tools. Explore MyPentest checks, confidence labels, limits and expert testing options.
World-Ready Security
You don't need to be insecure about the world: We've got your back.
Assess your authorized application, review finding evidence and retest fixes. Use the coverage and reporting limits to decide when you need a separately scoped expert engagement.
Why BugSnaps
Testing you can act on.
01
Real security testing
MyPentest maps your app, then runs 56 checks against it - including signed-in access-control tests - not a sample report.
02
Automation, then experts
Run an assessment after a release, then scope expert testing for business logic, chained attacks and anything that needs judgement.
03
Actionable findings
Every finding has evidence, a CVSS score, how sure we are, and the specific fix - ready for your tracker, or your CI as SARIF.
04
Built for developers and security teams
Scoped to domains you prove you own, non-destructive by design, and exports that fit how engineering already works.
From findings to fixes
Improve your website security with a clear next step.
A useful web application security assessment gives your team an affected path, evidence, severity and remediation. Check access control, exposed secrets, injection and session handling on systems you are authorized to test, then rerun the relevant checks after fixing them.
Plan your security assessment
Understand what to test, choose a workflow for your application, and compare the tools that fit your scope.
Practical security guides
Access control, APIs, sessions, evidence and remediation.
Workflows for your application
SaaS, ecommerce, multi-tenant apps and release validation.
Choose a testing tool
Sourced alternatives with strengths and operating trade-offs.
Run MyPentest free.
Start on the free plan - no credit card. Upgrade when you need more scans, or critical and high findings in full. Sign in, verify your domain, and see what it finds.