acme-shop.comacme-shop.comacme-shop.comEvery finding from earlier rounds is fixed and retested. No new findings in scope as of Dec 14.
acme-shop.comGET /api/cart?id=%27 → 500 at CartController.show (cart.js:42)
Fix: return a generic error page in production and log the trace on the server.
A website vulnerability scanner for sites you own. Every finding comes with evidence and fix steps, within 24 hours.
Free if nothing medium or higher turns up. Authorized testing of websites you've verified you own.
Add one DNS record, upload a file, or add a meta tag. Nothing is tested until ownership is verified.
Testing runs only in the hours you approve, at the request rate you set, and skips the paths you exclude.
Each finding has its location, the evidence and the steps to fix it, within 24 hours of the window opening.
On a subscription, every round retests what was still open, so a fix is confirmed rather than assumed.
acme-shop.comAdd this record at your DNS provider. We check it automatically.
TXT@redround-verification=7134e001a5dfa488acme-shop.com/checkout, /adminhttps://acme-shop.com/loginSet-Cookie: session=…; Path=/; HttpOnly; Secure; SameSite=Lax
acme-shop.comEvery finding comes with where it is, the evidence, and how to fix it, mapped to OWASP and CWE. The full report is a web page and a PDF.
RR-2026-1014-0457Findings by severity
Scope
acme-shop.com and subdomainsExcluded: /checkout, /adminResults as of the test date, within the agreed scope. The full report lists every finding with evidence and fix steps.
Finding 2 of 6Location
https://acme-shop.com/login
Mapped to
A05:2021 Security Misconfiguration · CWE-614
Evidence
HTTP/1.1 200 OK Set-Cookie: session=…; Path=/; HttpOnly
How to fix
Add the Secure attribute so the cookie is only sent over HTTPS: Set-Cookie: session=…; Path=/; HttpOnly; Secure; SameSite=Lax
Verified Oct 15, 2026 · Retested in the next round
Nov 14, 2026Open findings stay in the report until a round confirms the fix.
Round 1 finished on Oct 14 and found 6 issues: 1 high, 2 medium and 3 low. Each one has the evidence and the steps to fix it.
View report
You get this email after every round.
Findings with evidence and fix steps, not a raw list you have to triage yourself.
Each finding is reproduced before it goes into your report, so you don't chase false positives.
We test only verified websites, inside the window and request rate you choose.
| Compared | Typical automated scanner | RedRound |
|---|---|---|
| Findings verified before reporting | Not always | Every finding |
| Ownership verified before testing | Not always | Always |
| Fix steps written for the finding | Generic advice | Specific to your site |
| You set the test window and rate | Not always | Yes |
acme-shop.com02:00Wed · UTC
Your report arrives within 24 hours of the start of your test window, so this is the latest it can arrive.
acme-shop.com/checkout, /adminVerify with a DNS record, a file, or a meta tag. A verified root domain covers its subdomains.
Testing runs only in the hours you approve and stops when the window closes.
Keep requests well below what your site can handle.
Leave out checkout, admin, or anything you'd rather we skip.
One test, or a new round every month that retests what was open.
one round, one website
You see a summary of findings by severity, the scope and the test date. If nothing medium or higher turns up, the full report is free.
Start free testSummary kept for 30 days. One free test per website every 180 days.
per report, one website
The full report for one round: every finding with its location, evidence, fix steps and OWASP and CWE mapping, as a web page and a PDF. You pay only when the round finds something medium or higher.
Get a single reportReport kept for 12 months.
per month, up to 5 websites
per year, up to 5 websites
A new round every month on each website, with the full report every time. Each round retests what was still open, so fixes are confirmed.
Choose BasicReports kept while you subscribe, and for 30 days after your subscription ends.
per month, up to 10 websites
per year, up to 10 websites
A new round every month on each website, with the full report every time. Each round retests what was still open, so fixes are confirmed.
Choose ProReports kept while you subscribe, and for 30 days after your subscription ends.
per month, up to 30 websites
per year, up to 30 websites
A new round every month on each website, with the full report every time. Each round retests what was still open, so fixes are confirmed.
Choose EnterpriseReports kept while you subscribe, and for 30 days after your subscription ends.
Prices in US dollars, excluding taxes, which are calculated at checkout. A website is one hostname: www.example.com and app.example.com count as two. You can switch a website once every 30 days.
Add your website, verify it with one DNS record, file or meta tag, and pick a test window. Nothing runs until you approve it.