MyPentest · by BugSnaps
Run a real automated pentest — free during launch.
MyPentest maps your web app's attack surface, then tests it for what attackers actually use: exposed secrets, broken access control, injection, weak sessions and known vulnerabilities. You get evidence, CVSS scores and fixes — not a sample report.
View an example reportAlready have an account? Open MyPentest
Free during launch · No credit card · 10 scans a day
- Verified
- Mapped
- Tested
- Reported
Findings
194 in 41 groups
4 critical · 8 high
- Critical
Environment file exposed
CVSS 9.8 · confirmed · CWE-538
- Critical
Command injection: shell echo output visible from 'host'
CVSS 9.8 · confirmed · CWE-78
- Critical
SQL injection (error-based) in 'q' parameter
CVSS 9.8 · confirmed · CWE-89
- Critical
Server-Side Template Injection in 'name' (Jinja2/Twig)
CVSS 9.8 · confirmed · CWE-1336
How an assessment runs
From a domain to a fix list, in one run.
Every step happens in the app, and nothing is sent to your site until ownership is proved.
- 01
Enter your target
The domain of a web app you own or are authorised to test.
- 02
Prove you own it
Publish one DNS TXT record. The value is tied to your account, so nobody else can use it.
- 03
Configure the assessment
Passive or deeper safe-active testing, subdomains, extra ports, and optional test accounts for signed-in testing.
- 04
Discovery
The crawler maps pages, forms, APIs, JavaScript-referenced endpoints and login surfaces — within your scope only.
- 05
Testing
Checks run against what was found. Watch progress live; stop at any time.
- 06
Findings and fixes
Severity, confidence, evidence and remediation for each issue. Export it, and find it again in your history.
What it tests
56 checks, aimed at the issues that get apps breached.
32 passive checks that only read, and 24 safe-active checks that send harmless probes or sign in as your test accounts. A pattern on its own is never reported as a vulnerability.
Leaked keys and secrets
API keys in JavaScript bundles and source maps, exposed .env and .git files. It tells a public client key from a server secret.
CWE-798 · CWE-312
Broken access control
Signs in as your test accounts and checks whether one user can read another's records (IDOR / BOLA), and whether logout really ends a session.
CWE-639 · OWASP A01
Injection
SQL, command, template, XML, LDAP and NoSQL injection with harmless canary inputs, plus DOM XSS traced from source to sink.
CWE-89 · CWE-78 · CWE-79
Sessions and tokens
Tokens in browser storage, weak JWT handling, cookies without Secure/HttpOnly/SameSite, session fixation.
CWE-922 · CWE-347
Hidden API surface
Endpoints referenced in your JavaScript, OpenAPI documents, GraphQL introspection and WebSockets — mapped so they get tested too.
OpenAPI · GraphQL · WebSocket
Configuration and known CVEs
Security headers, CORS, TLS, debug endpoints, end-of-life software and version-matched CVEs, with CISA KEV status.
CVSS 3.1 · CISA KEV · EPSS
The free version
The whole engine, not a teaser.
Free accounts get discovery, all 56 checks, authenticated testing and every export. The limits are about volume — 10 scans a day, 200 URLs per scan — not about hiding findings.
It does
- Maps and tests the live application you verified
- Sends harmless probe inputs and reads how the app responds
- Signs in as test accounts you supply, once each
- Reports evidence and how certain each finding is
It never does
- Exploit, change, create or delete your data
- Run denial-of-service, brute-force or password guessing
- Touch anything outside the scope you verified
- Replace a human tester for business-logic abuse
On the roadmap
Planned, and labelled as planned.
These are not available yet. When they ship, they'll appear in the app — not before.
- Scheduled retests and diffing between assessmentsPlanned
- Team workspaces and shared assessmentsPlanned
- Shareable read-only report linksPlanned
- API testing from an imported OpenAPI definitionPlanned
FAQ
Questions people ask before their first run.
Is MyPentest really free?
Yes, during launch. You get the full engine — discovery, all checks, authenticated testing and every export — within daily usage limits. No credit card is asked for. Paid plans with higher limits will come later and will be announced on the pricing page.
What do I need to run a pentest?
An account, and control of the domain's DNS so you can publish one TXT record. For signed-in testing, two or more test accounts on your app. You must own the target or have written permission to test it.
Will it break my site?
It is built not to. Checks are non-destructive: no exploitation, no data changes, no denial-of-service, and requests are paced. Running it against staging first is still good practice with any testing tool.
How is this different from a vulnerability scanner?
It maps the application first and tests what it finds, signs in as your test accounts to test access control between users, uses differential checks to confirm injection rather than pattern-matching, and reports confidence alongside severity. It does not exploit findings further, and it cannot judge business logic — that is what a manual BugSnaps engagement is for.
Where do my results go?
Results are produced by the MyPentest engine and saved to your account's private history, which only your account can read. Findings are never shared with anyone else.
Comparing options? MyPentest vs vulnerability scanners · Automated vs manual penetration testing
Run a real pentest on your app — free.
Sign in, prove you own the domain, and MyPentest maps and tests it. No credit card.