Most security reports fail the same way: 40 pages of "possible" issues, and nobody can tell which three are real. We built Xseth to fix that, and now we want your help deciding what the report itself should look like.

Quick recap of what Xseth does: it looks at your web app from the outside, the way an attacker would, narrows thousands of URLs down to the few worth testing, then validates each one. No install, no code access, no accounts. A finding is only marked PROVEN when a deterministic check confirms it, never on an AI's word alone. Everything else is labelled refuted, inconclusive, not tested or false positive.

We launched Xseth here a while back and have shipped a lot since, so here's what it actually does now, in one GIF. It runs external recon on a domain, cuts thousands of URLs down to the handful worth testing, then checks each one. A finding only gets marked PROVEN when a deterministic check confirms it, and everything else stays honestly labeled instead of padding a report. The GIF is an illustrative run on a demo target. We're opening the beta to bug bounty hunters and to teams shipping fast, including AI-built apps on Lovable, Bolt or v0. It's external only: no accounts, no code access, nothing to install. All we need is a domain you own or are authorized to test. In return, we'd love a few minutes of your time or one honest email on what was right, what was missing and what you'd never use. Drop a comment or reach us at xseth.com.