Question 1

Do you sign a Non-Disclosure Agreement (NDA) before scanning?

Accepted Answer

Absolutely. We never touch a line of code or scan any environment without a mutual NDA. All discovered data, report documents, and environment structures are encrypted and kept strictly confidential. We can sign your NDA or supply our startup-focused security NDA.

Question 2

How long does a standard VAPT audit take?

Accepted Answer

A standard API security or application audit takes between 5 to 10 business days. If you have an urgent enterprise deal close deadline, let us know during kickoff—we can expedite critical scoping to provide an initial vulnerability snapshot within 48 hours.

Question 3

What access requirements do you need to conduct the audit?

Accepted Answer

For web applications and APIs, we generally need access to a staging/sandbox environment with at least two user roles (to test privilege escalation) and Swagger/Postman API collection documents. For cloud audits, we require read-only access to your cloud dashboard logs and configurations.

Question 4

Do you offer retesting once we patch the vulnerabilities?

Accepted Answer

Yes, retesting is included in all packages. We believe finding a bug is only half the battle. Once your developers implement fixes, we retest the exact vectors and update your final VAPT audit report and Attestation Certificate to show 'Patched' status.

Question 5

Does your certificate help with SOC2 or ISO audits?

Accepted Answer

Yes! Auditors and enterprise procurement officers require proof of a third-party manual penetration test. Our Attestation Certificate and redacted executive summary report satisfy these requirements for SOC2 Type II, ISO 27001, GDPR, and RBI guidelines.

Question 6

What is your refund policy if no vulnerabilities are found?

Accepted Answer

We guarantee that our manual testing will uncover logic flaws or configuration vulnerabilities. If we run a full VAPT audit and find zero issues of any severity, and your code is proved to be 100% hardened, we offer a 50% discount on your next scoping round.

JWT Decoder & Security Analyzer

Paste Encoded Token

Decoded Header

Decoded Payload (Claims)

Signature Hash Code

JWT Authentication Flow

The "alg: none" Exploit

JSON Web Key Sets (JWKS)