Catch it if you can.
Or a stranger will.
Someone is going to find the holes in your software. The only question is whether it is you, on a Tuesday afternoon, or somebody else at three in the morning. Get your Provelex Score today.
The Provelex Score
Out of 100, recalculated on every run, tracked over time. It is deliberately simple to reproduce, because a number an auditor cannot check by hand is a number they will not accept.
100 − 18 × critical findings − 8 × high − 3 × medium − 1 × low
Each severity is capped, so one noisy accessibility sweep cannot swamp an otherwise sound application. The weights are printed in every report.
These are real findings, from real applications
Every one of these was shipped by a team who believed they had tested. None of them are exotic. All of them are the kind of thing that is obvious in hindsight and invisible beforehand.
A scanner finds the first one. A QA team finds the last one. Provelex finds both, and writes them up so the person approving the fix understands what it costs to leave it.
Five kinds of broken
No scripts. No selectors. No YAML.
If you can book a flight online, you can run Provelex. The person who needs the report is rarely the person who would write a test script — that is the whole point.
- 01Add your appPaste a URL and pick a profile. A starter test pack comes with it.
- 02Prove you own itA DNS record, a file, or a signed statement for a local address.
- 03Add a loginInto a sealed vault. Provelex signs in and shows you the screenshot.
- 04Tick what to checkFive toggles. Nothing else to configure.
- 05Read the reportA health score, ranked findings, and a branded PDF you can forward.
Everything is free except the AI
Adding applications, driving the browser, evidence, reports, PDF export, history — none of it costs credits, because none of it costs us anything. Only a scan spends money, so only a scan spends credits.
You start with 50 credits in India and 70 elsewhere — enough for a full scan either way — and top up with a card or a voucher. The exact price is shown before every run, never discovered afterwards.
Provelex will not test an address you cannot prove you own
It signs in with real credentials and actively probes for weaknesses, so ownership is proven before any of that runs — a DNS record, a file on the site, or a signed statement for a local address. The grant is stored with the application and reproduced in every report, which is exactly what an enterprise security team asks for. Until a target is verified, only the checks that send no payload will run.
Passwords are sealed with AES-256-GCM under an Argon2id-derived key, masked before every screenshot, and never appear in a report, a log, or an event.
Find your breaking point first.
It takes about three minutes to set up and the first scans are on us. The worst thing you will find today is cheaper than the best thing someone else finds tomorrow.