What a ₹499 security report can and cannot do (vs a pentest)

Updated 2026-10-25 · Trustfield

Short answer: a ₹499 report catches the obvious, high-frequency holes in an hour. A penetration test finds deeper, chained issues over weeks and costs 50–400× more. Most AI-built apps need the cheap one first — and a pentest later, only if the app holds real money or data.

What the report covers

• Secrets shipped to the browser (API keys, service-role keys, .env leaks)
• Open database rules (Supabase/Firebase), unauthenticated storage
• Missing security headers, CORS/cookie mistakes, exposed files and source maps
• Payment webhooks that are not verified
• AI prompt-injection exposure (12-attack kit)
• Dependency CVEs on repo scans

What it does not cover

• Authenticated testing and exploitation, business-logic abuse, chained attacks
• Mobile binaries, browser extensions, Shopify admin apps
• Compliance certification (SOC 2, ISO 27001)
• Any guarantee: a scan is a point in time

When a pentest is justified

You process payments at scale, hold health/financial data, or an enterprise customer requires evidence of a manual test. Otherwise fix the free/₹499 issues first: they are the ones that actually get exploited against small apps.

See the full comparison table Run a free scan

Trustfield is an external, read-only review. Not a penetration test and not a certification. Methodology · Security