Your scope comes first.
Choose the hosts, accounts, and actions you authorize. Start in staging; review production scope.
Read the testing checklistThe pentest that logs in.
Then keeps testing.
Find and fix vulnerabilities in your apps and APIs.
Behind the login. Every time you ship.
Free personal workspace. No sales call.
See what a finding looks likeAsk for the evidence.
See the request, the response, and the steps to check a finding yourself.
Inspect a sample findingConnect with care.
Use dedicated test accounts. Review data handling before connecting a production app.
Security & data handlingShopify store or WordPress website?
Choose the protection built for your platform.
Available now
Watch storefront scripts, app permissions, and webhooks. Apply approved fixes while your store keeps running.
Protect my Shopify store
Early access
Find vulnerable plugins and malware. Test repairs before they reach your live site.
Join WordPress early accessCustom web apps & APIs
Your app has rules.
Test that they hold.
From signed-in pages to the APIs behind them, test the boundaries your app is meant to enforce.
Inspect a sample findingAccount boundaries
Use separate test identities to check whether one customer can read another customer’s invoices, files, or records.
Roles & permissions
Try privileged actions as a regular member. Check the API directly, even when the interface hides the button.
Sessions & API access
Check expired tokens, logout, session handling, and the endpoints your signed-in users call.
Tests behind your loginProves every findingRetests as you ship
Your app. The full picture.
Illustrative product preview. Explore a sample finding.
Web apps & APIs
Add a URL, a test login, or an API spec. Test the routes your users actually reach.
Code & context
Connect source code to help trace a finding back to the route that needs fixing.
Continuous testing
Keep checking after the first scan. Reproduce new issues and verify the fixes you ship.
Find it.
Fix it.
Check it again.
Get the exact request, the response, and a fix you can work with. No guessing where to start.
Open a sample findingSAMPLE FINDINGMedium · 6.5
One account. Someone else’s invoice.
A signed-in member can read an invoice from another workspace by changing its ID.
Request as Workspace A member
GET /api/invoices/inv_8421 HTTP/1.1 Host: demo.harbor.test Authorization: Bearer [workspace-a-token]
Response
HTTP/1.1 200 OK
{
"workspace_id": "workspace_b",
"invoice_id": "inv_8421",
"total": 2400
}Workspace A can read Workspace B’s data.
Illustrative example. No live target.Download sample
Your first test starts here.
Bring an app. Add a login. Let rootscan do the digging.
From an authorized connection to a checked fix.
Set the scope
Choose your app and the routes it’s okay to test.
Connect a test login
Give rootscan a dedicated identity with test data.
Follow the evidence
Reproduce the issue and review a concrete fix.
Verify the change
Retest the issue and a legitimate user’s flow.
Shipped a fix?
Make sure it worked.
Rerun the original request, check the expected result, and keep an eye on what changes next.
- Deploy
- Recheck
- Verify
Try a sample release to see how fix verification works.
Start free. Keep building.
Application & API plans. One seat is one person in your workspace.
Free
Free
Your own workspace.
No monthly platform fee.
Pro
$19/ user / month
Scheduled tests, monitoring,
and team integrations.
Business
$29/ user / month
Team access controls,
reporting, and priority support.
Platform pricing. Scans and pentests billed separately.
Need SSO, private deployment, or a custom agreement? Talk Enterprise.
A few quick answers.
Then you can get started.
What do I need to start?
An app URL and permission to test it. Create a free account, then add a dedicated test login for authenticated coverage. A second identity helps check roles and tenant boundaries.
What is free?
A Free account has no monthly platform fee. Scans and pentests are charged separately based on consumption.
Does it test behind the login?
Yes. rootscan uses a real session to test signed-in workflows and APIs. With two identities, it checks whether one account can reach another account’s data or actions.
What do I get from a scan?
Confirmed findings with request-and-response evidence, a severity score, reproduction steps, and a suggested fix. You can retest after making a change.
Can I try it on a production app?
Start with staging and dedicated test accounts. For production, review the allowed scope and any state-changing actions first. The setup guide walks through it.
Test your app today.
Start with a URL. See what’s behind the login.
See pricing