On-demand · Safe mode
Safe, read-only pen testing for verified sites
On verified sites, run a read-only pen test when you choose. It checks what is publicly visible beyond the daily scan.
Your permission first. Verify ownership and confirm you’re authorised before each run.
No changes to your site. Up to 60 requests to public pages on the same site. No logins, form submissions or write requests.
Findings you can act on. See issues in your score, follow guided steps and save a report. Retest to confirm a fix.
Separate from daily scans. One run per site every 24 hours; up to three per workspace per day.
Example security report
app.example.com
Overall risk
High
1
Medium
1
Low
1
Executive summary
Three public-facing weaknesses were identified. Address the exposed file first because it may reveal credentials or configuration secrets.
Exposed environment file
Evidence · GET /.env returned HTTP 200
Recommended fix: Block dotfiles at the web server and rotate exposed credentials.
Session cookie missing SameSite
Evidence · session_id · Secure · HttpOnly
Recommended fix: Set SameSite=Lax or Strict on the application session cookie.
Server version disclosed
Evidence · Server: nginx/1.22.1
Recommended fix: Remove the version token from the Server response header.
Methodology
Eight read-only checks run against public pages on the same host: exposed files, admin & login pages, directory listings, software versions, session cookies, cross-origin rules, HTTP methods and homepage resources. Up to 60 unauthenticated GET requests; no logins, form submissions or write requests.
Limitations: black-box and public-facing only — no source, server config or internal network review. Findings are evidence-backed but not proof of exploitability, results are a point-in-time view, and rate limits can restrict some DNS lookups.
Example only. Your downloadable report includes methodology, evidence, impact, fix guidance and a prioritised action plan.
How a run works
Five steps, fully under your control.
- 01
Verify ownership
A DNS TXT record proves the site is yours.
- 02
Give consent
Confirm you're authorised. We record the time and wording.
- 03
Run safe checks
Eight read-only modules run with live progress.
- 04
Get the report
Findings join your score; download a full report.
- 05
Retest
After fixing, a new run confirms the issue is gone.
The eight checks
What each module looks for.
Exposed files
GET /.env /.git/config /backup.zip
Finds: Leaked secrets, source code, database dumps
Admin & login pages
GET /admin /wp-admin /phpmyadmin
Finds: Management panels open to the internet
Directory listing
Look for “Index of /” pages
Finds: Browsable folders revealing files
Software versions
Server, X-Powered-By, generator tags
Finds: Outdated releases with known issues
Session cookies
Inspect Set-Cookie flags
Finds: Missing Secure, HttpOnly or SameSite
Cross-origin rules
Origin header with credentials
Finds: Wildcard or reflected CORS
HTTP methods
OPTIONS request only
Finds: TRACE, PUT or DELETE advertised
Page links & resources
Passive homepage review
Finds: Mixed content, open redirect parameters
Strict request budget
Each run is capped at 60 requests, at most 4 at a time, with a 5-second timeout. Example run:
1
run / site / 24h
3
runs / workspace / day
1
host only
What a NicoServe pen test never does
- Submit forms or attempt logins
- Send attack payloads or injections
- Write, upload or delete anything
- Test other hosts or private networks
- Run without verified ownership and consent
Meet your AI security companion.
Connect your website, ask your first security question, and get clarity on what to do next. Monitoring, natural-language chat and guided fixes. Every feature included.
Natural-language chat · Daily checks · Guided fixes