No Pwn, No Pay
If a Hacktron Whitebox pentest finds no validated High or Critical issue in your application, we refund it.
Book a demo to start one, or read the sample report first.
Process
- Book a demo
-
Thirty minutes to agree on the application and the scope.
- Run the pentest
-
Hand over the source code from GitHub, GitHub Enterprise Server, GitLab or an archive. Add a deployed copy and test credentials when you want the attacks tried live.
- Get the report
-
The October 2026 sample pentest found one Critical and five High issues in an expense app. Any one of them means no refund.
-
Critical
Predictable password-reset tokens permit account takeover
-
High
Profile mass assignment allows an employee to become an administrator
-
High
Administrative user management lacks role enforcement
-
High
Expense details and deletion do not enforce record ownership
-
High
Receipt import can issue server-side requests to internal services
-
High
Managers can approve expenses outside their department
-
Medium
Receipt import stores unvalidated file types
-
Medium
CSV export discloses expenses belonging to other employees
-
Terms and conditions
- Access to source code is required for a pentest.
- Offer applies only to commercial pentest engagements booked using the “Book a demo” link above.
- Final severity is determined using CVSS v4 scoring on analyst-validated findings.
- Refund eligibility applies only when the final report contains no validated High or Critical severity findings within the agreed scope.
- Hacktron may decline engagements that are not a fit for this offer based on scope, commercial viability, or delivery constraints.
Book a demo to start one on these terms.