Security Audits That Don’t Guess.

Your code is handled under our full data retention policy. Tier 2 repos are cloned to an isolated temporary directory during scanning and destroyed immediately after the PDF is generated. We never store, share, or retain your source code beyond the scan session. Scan metadata (finding types, severity counts, timestamps) is retained per our data retention policy (365 days for Tier 2, 90 days for Tier 1) to improve detection accuracy over time. You can request full deletion at any time: security@pilum.io.

No. Tier 1 is passive-only. We make standard HTTP GET requests to publicly accessible URLs, fetch publicly served JavaScript bundles, read HTTP response headers, perform DNS lookups, and check certificate transparency logs. We make zero POST requests, zero authentication attempts, zero form submissions, and zero API calls with parameters. Your server logs will show requests from our scanner User-Agent (PilumIO-SecurityAudit/1.0). We rate-limit ourselves to 2 requests per second maximum and will never trigger your WAF.

Every Critical and High finding goes through a structured 3-pass challenge before it reaches your report. Pass 1 generates raw findings broadly. Pass 2 (fresh context) challenges each Critical/High and demands specific proof — it has never seen the codebase and brings no author bias. Pass 3 (separate instance) makes the final call: CONFIRMED, POTENTIAL, or REMOVED. POTENTIAL findings are flagged for human operator review before the PDF is generated. Only CONFIRMED findings ship in your report. Our target false positive rate on confirmed findings is under 5%.

No. For Tier 1: we only access publicly available information — no credentials required. For Tier 2: we test against your staging environment or use read-only test credentials you provide. We never require production database write access. If you’re running an OpenClaw agent, we audit the agent configuration and skill files — not live memory or production data stores.

The Pilum report contains: an Executive Summary in plain English (one page, suitable for sharing with non-technical stakeholders), a Risk Score from 0–100 based on CVSS 3.1, confirmed findings organized by severity with full evidence and OWASP mapping, a 3-level remediation playbook per finding (DIY copy-paste, free tool, or hire someone with exact brief), a scan limitations section disclosing anything we couldn’t test, and a scope notice. Tier 1 includes an IDS notice explaining what requests we made. A Pre-Launch Certificate page is included if zero Critical or High findings are confirmed.

When you pay, your job enters the operator queue. You receive a confirmation email with your queue position and estimated delivery time. The operator processes jobs in order within each tier’s delivery window: Tier 1 within 48h, Tier 2 within 3–5 days. During our portfolio phase, we’re running slightly above standard capacity to build our case study library — you’ll benefit from faster delivery during this period. If we’re AFK when you order, the queue holds your position — nothing is lost and delivery timing starts from confirmation, not from when we first see the order.

The Deep Audit is a one-time comprehensive scan. Guardian starts with the same Deep Audit, then adds continuous monitoring — monthly passive re-scans, delta analysis on code changes, and a full Deep Audit re-run every quarter. Think of it as: Deep Audit tells you what's wrong today. Guardian makes sure nothing new goes wrong tomorrow.

Yes. If you purchased a Deep Audit within the last 30 days, we'll credit the $1,499 toward your first Guardian quarter. Contact security@pilum.io to arrange this.

Guardian includes a full Deep Audit in your first week — the same $1,499 service we offer as a standalone product. Quarterly billing ensures we can deliver that level of depth sustainably while keeping your price well below what the individual services would cost separately.

Yes. Your current billing period (quarter or year) completes, then monitoring stops. No refunds for partial periods. You keep all reports generated during your subscription.

We have specialized detection patterns for Cursor, Bolt, Lovable, v0, Claude Code, OpenAI Codex, and Google Antigravity / Firebase-first stacks. Each tool has characteristic vulnerability patterns — for example, Bolt apps frequently expose Supabase service_role keys in frontend bundles, while Cursor apps tend to have inconsistent API route authentication. We fingerprint the builder tool in Pass 1 and activate the relevant specialized checklist automatically.

Yes. Email security@pilum.io with your URL and we’ll run a limited /sec-preview — up to 5 findings, severity indicators only, no remediation detail — at no charge. One free preview per domain per 24 hours. The full Tier 1 at $299 unlocks the complete report with all findings, CVSS scores, evidence, and 3-level remediation playbook.