SourceAI is a penetration testing service provider focused on application security, performed by CEH (Certified Ethical Hacker) certified personnel, delivered remotely worldwide, using a fixed-price model starting at 1,337 euros, with free retesting included.
In terms of purpose, SourceAI is designed to help businesses discover and fix security vulnerabilities in Web applications, APIs, and frontend and backend before hackers exploit them, preventing vulnerabilities from turning into actual data breach incidents.
Its main capabilities include five categories of services:
- Web penetration testing: complete security assessment of Web applications, covering the OWASP Top 10, authentication and authorization flaws, SQL injection, XSS and RCE detection, business logic vulnerabilities, and providing detailed remediation reports.
- API security testing: specialized testing for REST, GraphQL, and SOAP APIs, covering API authentication testing, rate limiting and DoS validation, data exposure analysis, authorization bypass testing, and API security best practices.
- Frontend and backend security: in-depth client-side and server-side security analysis, including frontend security analysis (JS, React, Vue), backend and server architecture audits, configuration and deployment testing, dependency and library analysis, and session and token security.
- Secure code review: identifying security flaws that automated tools cannot detect through manual code analysis, covering source code analysis, secure coding standards review, cryptographic implementations, third-party library audits, and training recommendations.
In terms of usage, users can request a security audit through the official website form, and the company states it will respond within 24 hours and provide a personalized quote. The testing methodology includes: information gathering and attack surface mapping, automated and manual testing, vulnerability verification and impact confirmation, and complete documentation including risk assessment, visual evidence, and prioritized remediation steps.
Applicable scenarios include various organizations from startups to enterprise-level clients, offering security packages such as single application, complex Web applications (including subdomain security, port scanning and enumeration, delivery within 7 days, including free retesting), and multi-application unlimited scope (including continuous security testing and custom reports).
In terms of limitations, the official materials do not mention specific technology stack compatibility scope, maximum testing duration, or refund policy; the pricing only states a starting price of 1,337 euros, and specific pricing for different packages is not yet provided; details regarding supported languages, regional restrictions, or compliance certification are also not yet provided.