v1.0 — self-hosted, source included

Budget-friendly vulnerability scanning & penetration testing for web systems — built for the age of AI-driven attacks.

AI-driven attacks are rising fast — automated recon, AI-assisted exploit generation, and bots probing every IP address on the internet around the clock. Most teams still can't justify enterprise pen-test pricing to defend against it. Secure Verification Services gives you real vulnerability scans and controlled, evidence-backed penetration tests at a fraction of the cost: nine scanning agents, a hard-coded tool allowlist per agent, and a scope file that gates every single action — enforced in code, not just in a README.

python3 · MIT-friendly source · runs fully offline except optional AI triage
secure-verification-services — orchestrator.py
01

"AI, hack this" tools scare you

Unscoped autonomous agents with shell access are a liability, not a tool — one bad prompt and you own the blast radius.

02

Point tools give you noise

Nmap, nikto, and a dozen scanners with no shared model of scope, no diffing across runs, and no compliance mapping.

03

You need to show your work

Clients and auditors want evidence, not vibes — a Markdown report with OWASP/CIS tags beats a chat transcript.

Architecture

One orchestrator. Nine scoped agents. Zero surprises.

Every agent subclasses the same base class: it must pass ScopeGuard.authorize() before touching a target, and it can only call binaries in its own hard-coded allowlist. The orchestrating LLM directs which agents run — it cannot expand what any agent is permitted to do.

Orchestrator

orchestrator.py

Reads scope.yaml, dispatches agents, defaults to --dry-run. Nothing executes for real until you pass --execute.

01Recon Agentdeterministic nmap / dig / whois enumeration.
02Web App Analyzerdeterministic Headers, robots.txt, stack fingerprinting.
03API Analyzerdeterministic OpenAPI/GraphQL discovery, verbose-error detection.
04Infrastructure Analyzerdeterministic TLS hygiene, SPF/DMARC/DNSSEC — never guesses a port.
05Code Analyzerdeterministic bandit / semgrep over a local, separately-authorized path.
06LLM Security Analyzerdeterministic Prompt-injection / jailbreak probes against your own LLM endpoint.
07Kubernetes Analyzerdeterministic Read-only cluster hygiene — privileged pods, RBAC, exposure.
08Exploit Agentseparately gated Declared, known techniques only — requires its own scope entry + resettable:true.
09AI Triage Analyzeropt-in AI The one LLM-powered step: prioritized narrative from the evidence bundle.
Safety model

Scope enforcement is the product, not a feature.

Everything below is enforced at the code level by ScopeGuard — not documentation you're trusting an LLM to remember.

■ allowlist

Explicit targets only

Scans refuse to run against anything not listed in your scope.yaml.

■ dry-run default

Nothing fires by accident

Every run prints planned actions first. Real execution needs an explicit --execute flag.

■ two-tier auth

Recon ≠ exploit

Being scannable doesn't authorize exploitation — that needs its own scope entry and a resettable: true disposable target.

■ full audit trail

Every action logged

Structured JSONL logging of every agent action to logs/agent-activity.jsonl.

What you get

Everything to run, report, and repeat a scan.

One-command lab + menu

start-system.sh is a single interactive entrypoint: run scans, view reports, manage local lab targets, start the API — no command memorization.

Learn more →

History + diffing

SQLite-backed run history per target with a diff engine that shows new / resolved / unchanged findings between scans.

Learn more →

Compliance mapping

Findings auto-tag to OWASP Top 10, CIS Controls v8, PCI DSS 4.0, and OWASP Top 10 for LLM Apps — with a coverage summary in every report.

Learn more →

Static dashboard

Generate a browsable HTML dashboard over your scan history — no server required to view it.

Learn more →

REST API

Wrap the orchestrator behind api.py to trigger scans and pull evidence from your own tooling.

Learn more →

Email alerting

Opt-in SMTP alerting when a scan turns up findings that weren't there last time.

Learn more →

Two live lab targets

Ships with DVWA and Kubernetes Goat tutorials pre-wired as safe, resettable practice targets.

Learn more →

Graceful degradation

Missing tool (no nmap? no kubectl?) records a tool-unavailable finding instead of crashing your run.

Learn more →

Full source, no lock-in

Plain Python, readable agents, no black-box binary. Fork it, extend it, run it air-gapped.

Learn more →
Pricing

One license. Full source. Yours forever.

Full platform
$79

one-time payment · lifetime updates · use on unlimited machines you own

  • Full source for all 9 agents + orchestrator
  • ScopeGuard authorization engine
  • DVWA + Kubernetes Goat tutorial labs
  • Report generator, dashboard, REST API
  • Compliance mapping (OWASP / CIS / PCI / LLM Top 10)
  • Setup docs + FUNCTIONAL_SPEC + TECHNICAL_SPEC
Buy now on Gumroad
Secure checkout via Gumroad · instant download link + email delivery
Built for real frameworks

Findings map to controls you already report on.

OWASP Top 10 (2021) OWASP Top 10 for LLM Applications CIS Controls v8 PCI DSS 4.0 JSONL audit log SQLite run history
Affiliate program

Recommend it. Get paid on every sale.

Payouts and tracking run entirely through Gumroad's built-in affiliate system — no separate login, no manual invoicing. Apply once, get a unique link, get paid automatically as sales come in.

1

Apply as a Gumroad affiliate

Use the link below to request affiliate access to Secure Verification Services — approval is typically same-day.

2

Share your unique link

Gumroad generates a personal tracking link and, if you prefer, discount codes you control.

3

Get paid automatically

Commission is credited on every sale attributed to your link and paid out on Gumroad's normal payout schedule — no chasing invoices.

Apply to become an affiliate
30%
commission on every referred sale
$79
SALE PRICE
$23.70
YOUR CUT
90-day
COOKIE WINDOW
FAQ

Before you buy

Mostly no, by design. Every scanning agent (Recon through Kubernetes) is fully deterministic rule-based code — regex, header checks, substring matching. Fully auditable, no model in the loop. The one AI-powered piece is the optional AI Triage Analyzer, which turns your evidence bundle into a prioritized narrative. It's opt-in, clearly labeled AI-generated, and never blended into the deterministic report.

No — and that's the point. Every agent calls ScopeGuard.authorize(target) before doing anything. Targets not explicitly listed in your scope.yaml are refused. This tool is for scanning infrastructure and applications you own or are explicitly authorized to test.

It proves impact against targets you've separately authorized for exploitation — not discovery. It executes declared, known techniques (SQLi, reflected XSS, command injection, weak-credential login) against declared endpoints you configure. It requires a resettable: true entry, enforced at scope-file load time, because it's meant for disposable lab containers, not production systems.

Python 3 with a virtual environment, and nmap for the Recon Agent's port scan step. bandit installs via requirements.txt. semgrep and kubectl are optional, only needed for Code Analyzer's deeper scan and Kubernetes Analyzer respectively. Any missing tool degrades gracefully.

Only if you opt in. Everything runs locally by default. The only feature that leaves your machine is --ai-triage, which shells out to Claude with your evidence bundle — entirely optional and off by default.

Handled through Gumroad's standard buyer protection at checkout. If the platform doesn't run in a standard Python virtualenv on Linux/macOS, reach out and we'll sort it out.

Contact

Questions before you buy?

Send a message and we'll get back to you in good time.

Stop wiring together nmap, bandit, and a prayer.

One scoped, auditable platform. Nine agents. A safety model enforced in code.