ScnFix Pentest
Contact
Share enough for a scope review. We will write back with questions or a quotation. You do not need to book a call.
Do not include secrets
The person who can answer scope questions.
A work address is preferred. We use it for status notes, not for passwords.
The organisation that will own the engagement.
The public site of the company. This can differ from the application under test.
Helps us understand the kind of data the application handles.
The product you want tested, not your whole company.
The address of the application itself, usually staging.
Choose “Not sure yet” if you do not know. You can send an API file below.
Leave blank if you do not know. An estimate is enough.
Do not paste a password or a token. Name the method only.
How many kinds of account the test should compare, such as user and admin.
Staging is the usual choice. Production is tested only if you later authorise it.
A target date for the report, not the day testing starts.
Why you are asking now. This does not start the test.
Name a questionnaire if one prompted this request. An assessment does not by itself satisfy SOC 2 or ISO 27001.
Stack, constraints, or how many test accounts you can provide later. Do not paste passwords or tokens.
Optional. OpenAPI or Postman, .json, .yaml, or .yml, up to 10 MB. The file is uploaded to ScnFix when you submit the request.
Invalid details stay on this page. A valid request is saved. A status email, when delivery is configured, does not include files or secrets.