MyPentest
WEB & API SECURITY
Built an app? See what needs attention.
Test your verified web app and review findings with evidence and suggested fixes.
Penetration testing · automated and expert-led
Website & API penetration testing.
Test your application with MyPentest, review vulnerability evidence and suggested fixes, then retest after remediation. Start free or scope an expert-led assessment.
Need a manual engagement? Book a security consultation
Free plan · No credit card · Only tests domains you prove you own
mypentest · demo.vulnerable-app.testReplay
- Verify
- Map
- Test
- Report
- Paths mapped
- 21
- Requests
- 1,741
- Findings
- 194
- Leaked keys and secrets
- CWE-798
- CWE-312
- Broken access control
- CWE-639
- OWASP A01
- Injection
- CWE-89
- CWE-78
- CWE-79
- Sessions and tokens
- CWE-922
- CWE-347
- Hidden API surface
- OpenAPI
- GraphQL
- WebSocket
- Configuration and known CVEs
- CVSS 3.1
- CISA KEV
- EPSS
How a scan runs
From a domain to a fix list, in four phases.
Nothing is sent to your site until ownership is proved, and nothing on it is changed.
01 · Verify
Prove you own it.
Publish one DNS TXT record. The value is tied to your account, so nobody else can use it.
phase 01 / 04 · verify── verify demo.vulnerable-app.test
› looking up the DNS TXT record
✓ record matches this account · ownership verified
› scope locked to demo.vulnerable-app.test
Example output · our deliberately vulnerable test app
02 · Map
Map the attack surface.
The crawler maps pages, forms, APIs, JavaScript-referenced endpoints and login surfaces - within your scope only.
phase 02 / 04 · map── map
› crawling pages, forms and scripts
› reading JavaScript for API endpoints
› found /api/orders/1
› found /session
› found /static/app.js
› found /.env
✓ 21 paths with results mapped
Example output · our deliberately vulnerable test app
03 · Test
Test it like an attacker would.
Checks run against what was found. Watch progress live; stop at any time. 32 passive checks only read; 24 safe-active checks send harmless probes or sign in as your test accounts.
phase 03 / 04 · test── test
✓ signed in as 3 test accounts
› 56 checks · passive and safe-active
! [critical] Environment file exposed
! [high] Login form submits over plain HTTP
! [medium] One user can read another user's record (IDOR)
Example output · our deliberately vulnerable test app
04 · Report
Get evidence and fixes.
Severity, confidence, evidence and remediation for each issue. Export it, and find it again in your history.
phase 04 / 04 · report── report
✓ 194 findings in 41 groups · 12 critical or high
› CVSS 3.1 · confidence · evidence · fix, for each
› 9 attack paths linked
› exports: JSON · MD · HTML · SARIF · PDF
Example output · our deliberately vulnerable test app
phase 01 / 04 · verify
── verify demo.vulnerable-app.test
› looking up the DNS TXT record
✓ record matches this account · ownership verified
› scope locked to demo.vulnerable-app.test
Example output · our deliberately vulnerable test app
Video walkthrough
How to use BugSnaps
Get to know MyPentest, BugSnaps' web application security assessment tool, in this quick video.
Watch on YouTube ↗- checks per assessment
- 56
- passive checks that only read
- 32
- safe-active checks
- 24
- export formats, SARIF included
- 5
The report
Findings you can hand straight to engineering.
Grouped findings with severity, CVSS 3.1, how certain each one is, the evidence, and the exact fix - plus attack paths and a remediation plan ranked by fix window.
mypentest · demo.vulnerable-app.testExample
- Verified
- Mapped
- Tested
- Reported
Findings
194 in 41 groups
4 critical · 8 high
- Critical
Environment file exposed
CVSS 9.8 · confirmed · CWE-538
- Critical
Command injection: shell echo output visible from 'host'
CVSS 9.8 · confirmed · CWE-78
- Critical
SQL injection (error-based) in 'q' parameter
CVSS 9.8 · confirmed · CWE-89
- Critical
Server-Side Template Injection in 'name' (Jinja2/Twig)
CVSS 9.8 · confirmed · CWE-1336
Products · The BugSnaps toolkit
Curiosity, meet clarity.
Four tools for the questions you want to answer, from suspicious links to your app's attack surface.
- 01 / 04
02 / 04MyRecon
DIGITAL FOOTPRINT
Curious about your digital footprint?
Explore public username leads, breach exposure and domain context on the web or Android.
- 03 / 04
EndpointRadar
ENDPOINT SECURITY
Get a clearer view of your Windows endpoint.
Scan locally, explore your report in the browser and review guidance for your next steps.
- 04 / 04
PhishLens
LINK SAFETY
That link look a little off?
Inspect a link's destination and common warning signs before you decide what to do next.
World-Ready Security
You don't need to be insecure about the world: We've got your back.
Assess your authorized application, review finding evidence and retest fixes. Use the coverage and reporting limits to decide when you need a separately scoped expert engagement.
Why BugSnaps
Testing you can act on.
01
Real security testing
MyPentest maps your app, then runs 56 checks against it - including signed-in access-control tests - not a sample report.
02
Automation, then experts
Run an assessment after a release, then scope expert testing for business logic, chained attacks and anything that needs judgement.
03
Actionable findings
Every finding has evidence, a CVSS score, how sure we are, and the specific fix - ready for your tracker, or your CI as SARIF.
04
Built for developers and security teams
Scoped to domains you prove you own, non-destructive by design, and exports that fit how engineering already works.
From findings to fixes
Improve your website security with a clear next step.
A useful web application security assessment gives your team an affected path, evidence, severity and remediation. Check access control, exposed secrets, injection and session handling on systems you are authorized to test, then rerun the relevant checks after fixing them.
Plan your security assessment
Understand what to test, choose a workflow for your application, and compare the tools that fit your scope.
API security test cases
Download a CSV matrix for ownership, roles and tenant boundaries.
Free pentest report template
Track evidence, remediation and retest outcomes in a reusable CSV.
BOLA vs IDOR explained
Understand object authorization failures and how to verify a fix.
Practical security guides
Access control, APIs, sessions, evidence and remediation.
Workflows for your application
SaaS, ecommerce, multi-tenant apps and release validation.
Choose a testing tool
Sourced alternatives with strengths and operating trade-offs.
Vulnerability briefings
Check what the security headlines mean for your site.
Understand affected software, verify deployed patches and use a scoped scan to review supported security checks.
React2Shell CVE-2025-55182: how to check your website's exposure
Understand React2Shell exposure, inspect deployed React Server Components dependencies, and combine patch verification with a scoped website security scan.
Read the guide →React Server Components security: DoS and source code exposure after React2Shell
Why an early React2Shell patch may leave separate RSC issues unresolved: review CVE-2026-23864, denial of service and source code exposure remediation.
Read the guide →Next.js October 2026 security update: RCE risks and deployment checks
Review the October 14 Next.js fixes for Cache Components RCE, CVE-2026-96889 image optimization RCE and Server Actions DoS, with a deployment checklist.
Read the guide →Run MyPentest free.
Start on the free plan - no credit card. Upgrade when you need more scans, or critical and high findings in full. Sign in, verify your domain, and see what it finds.