Three attack surfaces — web, mobile APK, GitHub repo — driven by Claude Sonnet 4.6 agents that exploit, prove, and report. Every scan is gated by Domain Control Verification and an AI-validated Rules of Engagement document. Pay per token through Polar.sh.
Every engagement gets the right model stack: Sonnet 4.6 for exploitation and recon, Haiku 4.5 for compliance and reporting, Opus 4.7 as rate-limit fallback. Prompt caching keeps cost-per-scan under your tier's threshold.
4-phase OWASP-aligned flow: recon, parallel vulnerability analysis, conditional exploitation with proof-of-concept, post-exploitation, and executive report.
Static analysis with apktool + jadx. Detects insecure storage, hardcoded secrets, exported components, network plaintext, debug flags. PoC examples per finding.
Whole-repo audit: secret leaks, dependency CVEs, IaC drift, auth/authz patterns, and policy bypasses across the codebase. Produces remediation tickets ready for issue tracker.
CLAUDE.md red-line: an AI pentest tool that doesn't gate execution is a legal hazard. AssurePort enforces two hard gates and a credit pre-authorisation before a single byte hits the target.
Three methods: _assureport.<domain> TXT record, <meta name="assureport-verification"> tag, or /.well-known/assureport-challenge.txt. Any one passes. Lookup runs through Cloudflare 1.1.1.1 DoH so it works on the edge.
Upload signed PDF. Claude Haiku 4.5 extracts signing party, in-scope targets, validity window, out-of-scope clause. Score ≥ 0.85 + future expiry → status valid. Otherwise 412.
Every scan reserves credits up-front in an immutable, append-only ledger (token_ledger with replay-safe idempotency_key). No credit, no scan. Refund on pipeline error.
1 credit = $0.01 of API spend. Average web scan ~6,000 cr ($60). Mobile ~3,000 cr ($30). GitHub ~2,000 cr ($20). Prompt caching keeps the actual cost-per-scan well below the headline number on most engagements.
No credit card up-front. We auto-create your tenant and credit $1 of starter balance the moment you click your magic link.
Start with email →