6 findings, only 1 is real. Can you spot which one our scanner proved?

A little game, because it explains what we built better than any pitch.

Picture a typical freshly shipped SaaS: Next.js front end, Supabase back end, a few API routes. You run an external scan on it and recon flags these 6 candidates. When the validation step finishes, exactly one of them is PROVEN. The other five end up refuted, inconclusive, not tested or false positive.

Which one is real?

A. /api/admin/users returns a 500 instead of a 401 when you send a malformed token

B. The Supabase anon key is visible in the JavaScript bundle

C. /.git/config exists on the server but returns 403

D. /api/invoices/1043 returns a different account's invoice when you change the ID while logged in as yourself

E. The Server header reveals nginx/1.18

F. /api/link-preview?url= fetches any URL you give it, but requests to internal addresses get blocked

Reply with your letter and one line on why. I'll post the answer in the comments tomorrow, with what happened to each of the other five, because the reasons they didn't make it are the interesting part. (It's an illustrative app, not a customer's, but every one of these is a pattern we see on real targets.)

That's what Xseth does: it looks at your web app from the outside the way an attacker would, narrows thousands of URLs down to the few worth testing, then validates each one. A finding is only PROVEN when a deterministic check confirms it, never because an AI said so. No install, no code access, no accounts.

Want to play this game with your own app instead? We're opening a small group of free spots:

Beta user: send a domain you own or are authorised to test. We scan it and send you everything we find, including "nothing" if it's nothing.

Design partner: same scan, plus a direct line to me and my co-founder and a real say in what we build next.

DM me here or email benkriefsyef@xseth.com. No pitch attached.