Budget-friendly vulnerability scanning & penetration testing for web systems — built for the age of AI-driven attacks.
AI-driven attacks are rising fast — automated recon, AI-assisted exploit generation, and bots probing every IP address on the internet around the clock. Most teams still can't justify enterprise pen-test pricing to defend against it. Secure Verification Services gives you real vulnerability scans and controlled, evidence-backed penetration tests at a fraction of the cost: nine scanning agents, a hard-coded tool allowlist per agent, and a scope file that gates every single action — enforced in code, not just in a README.
"AI, hack this" tools scare you
Unscoped autonomous agents with shell access are a liability, not a tool — one bad prompt and you own the blast radius.
Point tools give you noise
Nmap, nikto, and a dozen scanners with no shared model of scope, no diffing across runs, and no compliance mapping.
You need to show your work
Clients and auditors want evidence, not vibes — a Markdown report with OWASP/CIS tags beats a chat transcript.
One orchestrator. Nine scoped agents. Zero surprises.
Every agent subclasses the same base class: it must pass ScopeGuard.authorize() before touching a target, and it can only call binaries in its own hard-coded allowlist. The orchestrating LLM directs which agents run — it cannot expand what any agent is permitted to do.
orchestrator.py
Reads scope.yaml, dispatches agents, defaults to --dry-run. Nothing executes for real until you pass --execute.
Scope enforcement is the product, not a feature.
Everything below is enforced at the code level by ScopeGuard — not documentation you're trusting an LLM to remember.
Explicit targets only
Scans refuse to run against anything not listed in your scope.yaml.
Nothing fires by accident
Every run prints planned actions first. Real execution needs an explicit --execute flag.
Recon ≠ exploit
Being scannable doesn't authorize exploitation — that needs its own scope entry and a resettable: true disposable target.
Every action logged
Structured JSONL logging of every agent action to logs/agent-activity.jsonl.
Everything to run, report, and repeat a scan.
One-command lab + menu
start-system.sh is a single interactive entrypoint: run scans, view reports, manage local lab targets, start the API — no command memorization.
History + diffing
SQLite-backed run history per target with a diff engine that shows new / resolved / unchanged findings between scans.
Compliance mapping
Findings auto-tag to OWASP Top 10, CIS Controls v8, PCI DSS 4.0, and OWASP Top 10 for LLM Apps — with a coverage summary in every report.
Static dashboard
Generate a browsable HTML dashboard over your scan history — no server required to view it.
REST API
Wrap the orchestrator behind api.py to trigger scans and pull evidence from your own tooling.
Email alerting
Opt-in SMTP alerting when a scan turns up findings that weren't there last time.
Two live lab targets
Ships with DVWA and Kubernetes Goat tutorials pre-wired as safe, resettable practice targets.
Graceful degradation
Missing tool (no nmap? no kubectl?) records a tool-unavailable finding instead of crashing your run.
Full source, no lock-in
Plain Python, readable agents, no black-box binary. Fork it, extend it, run it air-gapped.
One license. Full source. Yours forever.
one-time payment · lifetime updates · use on unlimited machines you own
- ✓ Full source for all 9 agents + orchestrator
- ✓ ScopeGuard authorization engine
- ✓ DVWA + Kubernetes Goat tutorial labs
- ✓ Report generator, dashboard, REST API
- ✓ Compliance mapping (OWASP / CIS / PCI / LLM Top 10)
- ✓ Setup docs + FUNCTIONAL_SPEC + TECHNICAL_SPEC
Findings map to controls you already report on.
Recommend it. Get paid on every sale.
Payouts and tracking run entirely through Gumroad's built-in affiliate system — no separate login, no manual invoicing. Apply once, get a unique link, get paid automatically as sales come in.
Apply as a Gumroad affiliate
Use the link below to request affiliate access to Secure Verification Services — approval is typically same-day.
Share your unique link
Gumroad generates a personal tracking link and, if you prefer, discount codes you control.
Get paid automatically
Commission is credited on every sale attributed to your link and paid out on Gumroad's normal payout schedule — no chasing invoices.
Before you buy
Mostly no, by design. Every scanning agent (Recon through Kubernetes) is fully deterministic rule-based code — regex, header checks, substring matching. Fully auditable, no model in the loop. The one AI-powered piece is the optional AI Triage Analyzer, which turns your evidence bundle into a prioritized narrative. It's opt-in, clearly labeled AI-generated, and never blended into the deterministic report.
No — and that's the point. Every agent calls ScopeGuard.authorize(target) before doing anything. Targets not explicitly listed in your scope.yaml are refused. This tool is for scanning infrastructure and applications you own or are explicitly authorized to test.
It proves impact against targets you've separately authorized for exploitation — not discovery. It executes declared, known techniques (SQLi, reflected XSS, command injection, weak-credential login) against declared endpoints you configure. It requires a resettable: true entry, enforced at scope-file load time, because it's meant for disposable lab containers, not production systems.
Python 3 with a virtual environment, and nmap for the Recon Agent's port scan step. bandit installs via requirements.txt. semgrep and kubectl are optional, only needed for Code Analyzer's deeper scan and Kubernetes Analyzer respectively. Any missing tool degrades gracefully.
Only if you opt in. Everything runs locally by default. The only feature that leaves your machine is --ai-triage, which shells out to Claude with your evidence bundle — entirely optional and off by default.
Handled through Gumroad's standard buyer protection at checkout. If the platform doesn't run in a standard Python virtualenv on Linux/macOS, reach out and we'll sort it out.
Questions before you buy?
Send a message and we'll get back to you in good time.
Stop wiring together nmap, bandit, and a prayer.
One scoped, auditable platform. Nine agents. A safety model enforced in code.