Is your AI-built app ready for the world?
A short, manual penetration test for small, vibe-coded apps: built largely with AI and ready to go live. You fill in the form and pay securely. Within ~2 working days you'll hear whether we take your app on; if we do, we schedule the test within a week and you get the report after that, retest included.
Business? You reclaim the VAT. EU outside NL with a valid VAT number: reverse-charged (0%).
I'm Sofyan Aarrass, an OSCP-certified pentester with a master's in Cyber Security. No account managers, no juniors, nothing outsourced. From start to finish you work with the same person who runs the test and writes the report.
I've tested for municipalities, healthcare and education, and I know what's at stake once personal data or payments flow through your app.
- Authentication & session management
- Authorization / access control (IDOR, missing endpoint checks)
- Exposed API keys and secrets
- The OWASP Top 10 classes that most often go wrong in AI-generated code
- Manual verification — not raw scanner output
- Full infrastructure or network pentest
- Load / performance testing
- Source-code audit of the entire codebase
- Large apps with many endpoints (we'll send a custom quote for those)
Bigger or more complex app? See the web application pentest.
You pay securely via Mollie
iDEAL, credit card or bank transfer. Your details are encrypted end to end; we never see your payment data.
You get access to your secure portal after payment
We create your account straight away and email you an invite. All the sensitive work happens there, not on this form.
You prove the app is yours in the portal
You publish a short verification token on your own app. We check it by hand; we never fetch your app automatically. That way only the real owner can have a test run against their app.
You provide the details — encrypted in your browser in the portal
A technical description of the app (we give you a ready-made AI prompt that generates it for you) and test credentials. Everything is encrypted in your own browser before it's sent. Only we can open it; our servers only ever see ciphertext.
We review your request within ~2 working days
Accepted (test scheduled within a week), a custom quote if it's more work, or declined with a full refund. Then you get the report; a retest is included.
Verifiable report
Every report is digitally signed (Ed25519) and independently verifiable, entirely in your own browser.
Verify a report →Sample report
See exactly what you get: a complete sample report from start to finish, for a fictional client.
View the sample →Manual, not a scanner
Tested by an OSCP-certified pentester who finds what scanners miss: IDOR, broken authorization, leaked secrets.
Is your app larger than the fixed scope, or does it have multiple roles and integrations? Then choose a Security Quick Scan (one day of manual pentesting, €1,000 excl. VAT) or a multi-day penetration test. We scope those in a short intake. Want a broader review of your AI-built app, with an intake and Supabase/Firebase rules? See vibe-coded app security.
What if you reject my app?
If your request is declined after payment, for example because the app is too large or out of scope, you get the full amount back. We cover Mollie's transaction fee.
What exactly do you test?
Manual testing of authentication and session management, authorization and access control (IDOR, missing endpoint checks), exposed API keys and secrets, and the OWASP Top 10 classes that most often go wrong in AI-generated code. Not raw scanner output. Bigger or more complex apps? See the web application pentest.
How do I hand over credentials securely?
Only after payment, in your secure portal. Everything you upload is encrypted in your own browser before it's sent; our servers only ever see ciphertext. You never put credentials in the request form.
What if nothing is found?
Then you have it in writing that your app withstands a manual attack by an OSCP-certified tester. Valuable proof for customers, investors or an audit. The report is digitally signed and verifiable.
Do I get a retest?
Yes. One retest is included: after you've fixed the findings, we check that they're really resolved. Request the retest within sixty days of delivery.
How do I know the report is really from Resync?
Every report is digitally signed with Ed25519. You verify it yourself at re-sync.nl/verify/, entirely in your own browser and without uploading the file.