Free
See what Vulnix finds on your own product.
$0
Free, no card needed
1pentest, once
5PR reviews a month
- Low and medium findings in full
- First Validate Fix free, then $3 a re-test
- High and critical: count shown, details locked
Pricing
Pentest every release.
Real attacks on the product you ship, priced so you can run them every month. Your first pentest is free.
Builder
For founders and builders shipping one product.
Regular price $149$49/mo
Launch price
1pentest a month
20PR reviews a month
- Every finding in full, with the agent trace
- Validate Fix and fix pull requests
- Extra pentests at $39
Startup
RecommendedFor teams shipping several times a month.
Regular price $299$99/mo
Launch price
3pentests a month
50PR reviews a month
- Everything in Builder
- Scheduled pentests, API and webhooks
- Extra pentests at $29
Pro
For teams that ship continuously.
Regular price $899$299/mo
Launch price
12pentests a month
200PR reviews a month
- Everything in Startup
- Merge gate and audit log
- Priority queue and support
Enterprise
For organizations with their own requirements.
Custom
Priced per customer
Custompentest volume
CustomPR review volume
- Dedicated onboarding
- Security questionnaire answers
- Signed data processing agreement
Every plan gets the same pentest. Paying buys more of them and the full proof, never a better attack.
- 01
Always full depth
There's no quick mode. Every pentest, on every plan, runs at full depth.
- 02
Blackbox or whitebox, same price
Test the live app or connect the code. Either one is one pentest.
- 03
PR reviews are separate
Reviewing a pull request never uses one of your pentests.
- 04
Unused pentests carry over
What you don't use rolls into next month, up to one month's worth. Need more sooner? Buy extra pentests that never expire.
- 05
Connect GitHub, get 10 reviews
Your next 10 pull requests are reviewed free, on top of your monthly reviews. Past those, turn on $1 reviews or upgrade.
- 06
Only what you own
Vulnix tests only domains you've verified, each run in its own sandbox, with your test accounts encrypted.
Compare plans
| Feature | Free | Builder | Startup | Pro | Enterprise |
|---|---|---|---|---|---|
| Usage | |||||
| Pentests | 3 a month | ||||
| Unused pentests carry over | Up to 6 | ||||
| Extra pentests | $29 each | ||||
| PR reviews | 50 a month | ||||
| GitHub bonus | 10 PR reviews | ||||
| PR reviews past the allowance | $1 each, opt-in | ||||
| Yearly billing | $990 a year | ||||
| Queue priority | Standard+ | ||||
| Pentesting | |||||
| Blackbox pentesting | |||||
| Whitebox pentesting | |||||
| Authenticated testing | |||||
| External infrastructure | |||||
| Scope controls | |||||
| Scheduled pentests | |||||
| Findings & reports | |||||
| Low and medium findings | |||||
| High and critical findings | |||||
| Agent trace | |||||
| Validate Fix | |||||
| Reports: PDF, DOCX, JSON, SARIF | |||||
| Security dashboard | |||||
| Code | |||||
| PR reviews on GitHub | |||||
| Fix pull requests | |||||
| Merge gate | – | ||||
| Knowledge | |||||
| Automation | |||||
| REST API | |||||
| Signed webhooks | |||||
| Notifications | |||||
| Team & support | |||||
| Roles | |||||
| Audit log | – | ||||
| Support | |||||
| Dedicated onboarding | – | ||||
| Security questionnaire and DPA | – | ||||
FAQ
How do I pick the right plan?
Start free to see a real pentest on your own product. Builder ($49/month) is one pentest a month and 20 PR reviews, for a founder shipping one product. Startup ($99/month) is three pentests and 50 PR reviews, with scheduled pentests, the API and webhooks, for a team shipping several times a month. Pro ($299/month) is twelve pentests and 200 PR reviews, with the merge gate, the workspace audit log, priority in the queue and priority support, for teams that ship continuously. Enterprise is custom volume with dedicated onboarding, answers to your security questionnaire and a signed data processing agreement.
What counts as one pentest?
One full-depth pentest of a verified live app (blackbox) or a connected repository (whitebox). Both cost the same: one pentest. There's no quick mode; every pentest on every plan runs at full depth.
What does the Free plan include?
One full-depth pentest, blackbox or whitebox, and 5 PR reviews a month, with no card required. Low and medium findings show in full, and your first Validate Fix re-test is free, then $3 a time. High and critical findings show their severity and count, and their details, the agent trace and the report unlock on a paid plan.
Do PR reviews use my pentests?
No. PR reviews have their own monthly allowance on every plan and never use a pentest. Connecting GitHub adds 10 more, free, once, on top of your monthly reviews.
What if I run out of PR reviews?
Reviews stop until your allowance renews, unless you turn on extra reviews in your billing settings: then each review past the month's is $1 on your next invoice, up to a monthly cap you choose. It's off until you turn it on.
What happens when I've used my pentests for the month?
Your allowance renews with your billing month. Need more before then? Buy extra pentests from your billing settings ($39 each on Builder, $29 on Startup, $25 on Pro); they never expire. Or upgrade, which takes effect immediately with the new plan's full allowance.
Do unused pentests carry over?
Yes, for one month. Whatever you don't use rolls into the next month, up to one month's worth, so you can bank up to twice your plan: 2 on Builder, 6 on Startup, 24 on Pro.
Is there yearly billing?
Yes. Paying yearly costs ten months' price for twelve: $490 for Builder, $990 for Startup and $2,990 for Pro, two months free. Your pentests and PR reviews still arrive month by month.
Can I change my plan?
You can upgrade at any time from your billing settings, and move a monthly plan to yearly; it takes effect immediately, starting a new billing period at the new price. Enterprise plans are set up with the Vulnix team.
Can I get a refund?
Yes, if you ask within 14 days of a payment and haven't used anything in that billing month: no pentest, PR review or chat. Write to support@vulnix.dev. Once something has been used, that month's payment isn't refunded, and a pentest that starts is counted even if it doesn't finish.
Are the API and webhooks included?
On Startup, Pro and Enterprise. The REST API uses scoped personal and service tokens, and signed webhooks can notify up to 10 endpoints about pentests, PR reviews, findings and domains. A pentest started through the API counts the same as one started in the app.
What's the difference between blackbox and whitebox pentesting?
Blackbox pentesting tests your live domains, applications, APIs and public IP ranges from the outside, the way an external attacker would, with no access to your code. Whitebox pentesting connects to your repository so the agent tests with full visibility into your codebase, and can attack a verified live target at the same time.
Is it safe to point Vulnix at my systems?
Vulnix only tests domains you've proven you own, by DNS record or through Cloudflare or Vercel. Every pentest runs in its own isolated sandbox, test credentials are encrypted and only decrypted inside that run, and you control excluded paths, request rate limits and testing windows.
Who is behind Vulnix?
Vulnix is built and operated by Vulnix Dev, Inc., a Delaware corporation incorporated in 2026. Our registered address is 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Email hello@vulnix.dev for sales or support@vulnix.dev for help with your account.