Authorized AI pentesting vs header scanners

Header checks are a starting line, not a finish

Most free “website security” tools fetch your homepage and grade TLS, CSP, HSTS, and cookie flags. That is useful. It is not a penetration test. Attackers do not stop at headers. They log in, replay reset tokens, walk /api/users/1 then /api/users/2, and scrape keys from your JavaScript bundle.

AIPentest is built for that second class of work: authorized, read-only testing of modern web apps — typically Next.js, Supabase, FastAPI, or similar stacks — after you prove you own the target.

What a header scanner will never see

• Email verification skipped on a “protected” route
• Session tokens that never rotate when a user becomes admin
• IDOR on export endpoints
• Wildcard CORS on authenticated APIs
• Stripe or OpenAI keys in NEXT_PUBLIC_* or response headers

Those issues show up as logic and authorization bugs. They need a session, a second test account, and an agent that chains recon → auth → object access.

Authorization is the product, not a disclaimer

Before any active testing, AIPentest requires ownership proof: DNS TXT, HTML meta tag, or a /.well-known file. That is the difference between a responsible scan and someone else’s production app.

Testing is read-only. Workers do not write to your database. Credentials you supply for authenticated checks stay in a vault — they are not pasted into model prompts.

Free grade vs the $99 brief

A free scan still runs agents. You see a security grade and one validated finding. Unlocking the brief ($99, one-time) reveals the rest: every issue, evidence, attack-surface map, and a PDF you can send to an enterprise security questionnaire.

If you ship weekly, the Developer plan ($29/month) raises project and scan limits so this is not a one-off.

When to run it

Run an authorized scan after you ship auth, before you invite an enterprise buyer, and after you rotate keys. A typical quick scan finishes in well under 30 minutes. That is the gap between “we should schedule a $20K pentest next quarter” and “we patched IDOR before Monday standup.”

Start from aipentest.app with a URL you own.