What people ask before a quote.

Short answers. For the contract wording, see the terms page.

Is this a penetration test?

No. I test from a customer’s account and stay within what a customer can reach, so there are no exploit attempts, no source code review and no legal opinion. If you need a penetration test, hire a pen tester as well; the two cover different ground.

What do you need from us?

The product, the one scenario you care about most, and a trial or test account. If the trial is too short for the scenario, a test workspace with a longer clock.

How long does it take?

About two weeks from kickoff to report. A retest takes a few days. The clock starts when the scope is signed and the first half is paid.

Will you publish anything?

No. The findings are yours and stay private. If you agree in writing, one anonymized line can go on the track record page, without the product’s name, the vendor’s name or any other detail that would identify either.

Why one scenario?

So each finding can be rerun. With one scenario, a finding can say that routing failed with the human step on its default filter, at 9:16 PM, screenshots 10 to 13, and your engineer can rerun it from that line. Spread across the whole product, the same two weeks would give thinner answers.

What does the network check actually do?

I keep the browser’s network log open for the whole session on the customer-facing side, list each host the product contacts, and compare that list with what your privacy policy and docs say. Hosts that are not named go in the report as not named, with no claim about why.

Do you test local or self-hosted tools too?

Yes. For a desktop or self-hosted tool the setup phase is the install, and the network check runs at the wire level on the machine. Four of the five products on the track record were local tools.

How is this different from the reviews on OpenSourcesAI?

Those are editorial, free to read, and chosen by the site. This is private work you pay for, on a scenario you choose, and it does not turn into coverage there. The about page explains how the two are kept apart.

Can you sign an NDA?

Yes. The report is confidential by default under the engagement terms; if you need your own NDA on top, send it with the request.

What if you find nothing?

Then you get a report that says so, with the same timestamps and screenshots, and you can show it to the customer who asked. It has not happened yet. The price is the same either way.