Compare: what actually checks your app?
Honest table. We are not a penetration test and we say so.
| Option | Typical price | What it checks | Time | Best for |
|---|---|---|---|---|
| Trustfield report | ₹499 one-time | Public JS keys, database rules (Supabase/Firebase), payment webhooks, headers, CORS, cookies, exposed files, AI prompt injection, dependency CVEs (repo scans) | ~60 seconds | AI-built apps that need the obvious holes fixed before launch |
| Free scanner (ZAP, Burp CE, Sucuri) | ₹0 | Many technical alerts, little prioritisation; usually no plain-English fix or AI-builder prompt | 30–90 min setup | Developers who can read raw tooling output |
| Fiverr "vibe-code audit" | ₹2,000–12,000 | Varies wildly by seller; often a manual read of the code, not the running app | 2–5 days | One-off reassurance, if the seller is good |
| Penetration test (agency) | ₹25,000–2,00,000+ | Authenticated testing, exploitation, business-logic abuse, retest | 1–3 weeks | Apps with real money or user data, before enterprise deals |
| Trustfield + pentest | ₹499 + pentest | Fast external check now, deep manual test later when it is justified | 60 sec + weeks | The honest sequence for most founders |
Where Trustfield is the wrong tool
- You need an exploitation-level pentest or a retest certificate.
- Your app is behind a login and you need authenticated testing.
- You need mobile apps, browser extensions or Shopify admin apps reviewed.
- You need a SOC 2 / ISO style compliance report.
Where it is the right tool
- You shipped with Lovable, Bolt, v0, Cursor, Replit or by hand and want to know what a stranger can reach.
- You want the exact fix and a prompt you can paste back into your builder.
- You want a cheap check after every deploy, with Watch for daily re-checks.
Trustfield is an external, read-only check: a point in time, not a guarantee. It is not a penetration test and not a certification. Methodology · Security · Run a free scan