Attack surface · Evidence · Verified fixes

See the risks.Verify the fix.

See your site’s attack surface in minutes. Every finding comes with its evidence, and it closes only when a retest proves the fix.

Access by invitationHow it works

Active tests run only on sites you have proven you own.

01See

Your whole surface, mapped in minutes.

Subdomains, endpoints, technologies and what changed since the last scan — drawn as one living map, not a spreadsheet.

12subdomains35endpoints5findings
ATTACK SURFACE · acme-shop.example
02Understand

Every finding shows its proof.

The exact request, the exact response, secrets masked. Then the fix for the stack you actually run.

HighEvidence · confirmedF-2101

Git repository metadata is publicly readable

GET https://www.acme-shop.example/.git/config

→ GET /.git/config HTTP/1.1
  Host: www.acme-shop.example
  User-Agent: TrustpectScanner/1.0 (+https://trustpect.com/security)

← HTTP/1.1 200 OK
  Content-Type: text/plain
  [core]
      repositoryformatversion = 0
  [remote "origin"]
      url = https://•••• masked@git.example/acme/shop.git

✓ confirmed · body matches git config signature
# /etc/nginx/sites-enabled/acme-shop.conf
location ~ /\.(git|svn|hg) {
    deny all;
    return 404;
}
03Verify

Fixed means proven, not promised.

Press “I fixed it”. We re-run the same check with the same scope, and the ring turns green only when the evidence says so.

✓Verified fixed
  1. 1Fix deployed — you pressed “I fixed it”
  2. 2Same check re-run, same scope
  3. 3Response compared with the original evidence
  4. ✓Verified fixed — recorded in your report
Before200 OK/.git/config · repo exposed
After404 Not Found/.git/config

How it works

Permission first. Evidence always. Closed only by proof.

  1. Prove ownership

    Verify your site with a DNS record, a file or a meta tag. Nothing active runs before that.

  2. Give explicit permission

    A separate consent with a time limit and a scan window. You can revoke it at any time.

  3. Scan only that origin

    Requests stay on the exact origin you approved, within a set budget. Discovered hosts are not in scope until you verify them.

  4. Get findings with evidence

    Request, response and confidence for each result, with a fix for your stack.

  5. Close by equivalent retest

    A finding closes only when the same check, with the same scope, passes again.

Then it keeps watch. Instead of re-scanning everything every day, Trustpect rescans when something changes: a new release, a changed fingerprint or a new advisory for the stack you run.

Honesty principles

We tell you what we know — and what we don’t.

Untested is not secure

Zero findings means the checks that ran found nothing. Coverage shows what did not run.

Partial is reported as partial

A timeout, a firewall block, a lost session or a spent budget makes a scan partial or inconclusive — never “clean”.

Results, not tool names

You see what was found and how it was proven. Which scanner ran is our job, not your homework.

No promises we can’t keep

No tool can guarantee complete security or catch every unknown flaw. We show exactly what was tested.

Built for the people who ship websites

One map. Three ways to win.

Agencies

Every client site on one deck.

Watch all client surfaces, catch what changed after each release, and send reports that prove the fix.

  • separate client workspaces
  • change-triggered checks
  • client-ready reports

Developers

Evidence you can reproduce.

Raw request and response, the fix for your stack, and a one-click retest after you deploy.

  • request / response proof
  • stack-aware fixes
  • retest after deploy

Small business

Know what to fix first.

Plain-language risks, prioritised, with a clear answer to “is it fixed now?”.

  • plain-language findings
  • priority, not noise
  • verified-fix history

Security

Your site, your keys, your rules.

Logins stay in an encrypted vault

Credentials you give for signed-in scans are encrypted per organisation, decrypted only inside the scan job, and never written to logs, reports or AI inputs.

Emergency stop

Stop any scan at any moment. Once stopped, no further request is sent.

Scan windows

Choose when scans may run, and set the pace your servers are comfortable with.

No request without permission

Traffic leaves from fixed, published addresses with an identifiable user agent — only to origins you approved.

How we keep scans safe

Access

Access is by invitation.

Trustpect currently works with invited users. Invitations are given by the founder, and your sign-in link arrives with the invitation.

  1. You receive an invitation with your sign-in link.
  2. You prove you own the site.
  3. You give time-limited permission; the first scan shows its estimate before it starts.
How access worksSee pricing