Simple plans. Pulse is free.
Lockpick checks your sites the way an attacker or an AI agent would, and tells you in plain words what to fix. Website scans never need your code. Repo and skill checks read public code and never run it.
Prices in USD
Free
$0/month$0/month
No card neededNo card needed
Pulse checks what your site exposes to the public.
For one site you want to keep an eye on.
Start freeYour plan See it in Billing
- 5 Pulse scans a month
- 1 site at a time, switch any time
- Weekly auto-checks, each uses one of your scans
- Your AI can start Pulse scans and read reports
- Plain-words reports and fix prompts
Deep
Recommended$19/month$15.83/month
Billed monthlyBilled yearly: $190. 2 months free
Deep follows routes and tests how your site handles access.
For founders who want to know what's really exposed, week after week.
Your first month is free. $0 today, then $19 a month. Cancel any time.
Your first 2 months are free. $0 for 2 months, then $19 a month. Cancel any time.
Get DeepGet Deep$19 charged every month. Renews automatically until you cancel. Cancel anytime in Billing.$190 charged once a year. Renews automatically until you cancel. Cancel anytime in Billing.
Your plan See it in Billing
- 20 Deep scans and 100 Pulse scans a month
- 10 sites
- Daily Pulse auto-checks included, emailed when something urgent appears
- Your AI can start Pulse and Deep scans and read reports
- 3 seats
- Plain-words reports and fix prompts
What Deep checks
- Up to 30 pages and 200 requests, plus everything a Pulse scan looks at
- Your API, including GraphQL, OpenAPI routes and CORS
- Supabase, Firebase and Convex access rules
- Up to 20 scripts and the libraries in them against known advisories
- Email and domain security, including DMARC, SPF and subdomain takeover
- Your lockfile against known advisories, from the CLI
Master Key
Coming soonFrom $49/monthFrom $40.83/month
Not on sale yetFrom $490 billed yearly · Not on sale yet
Checks whether one user can see another user’s data.
For apps where people sign in and keep their own data.
Join the waitlistYour plan See it in Billing
- Signs in to your app with two test accounts
- Checks whether one user can see another user's data
- Plain-words reports and fix prompts
Teams and agencies
Priced to your sites and teamPriced to your sites and team
More sites, seats and client workspaces.
For teams and agencies that check many sites. Tell us what you need.
Contact usYour plan See it in Billing
- Custom scan volume
- Unlimited seats
- Client workspaces and share pages with your name
- Priority queue and email support
- Plain-words reports and fix prompts
Need a few more Pulse scans?
10 extra Pulse scans for US$5. One payment, no subscription.
No expiry. For this workspace. Your included scans are used first. Site limits still apply. Tax may apply.
Repo and skill checks are free for everyone, on every plan. Paste a public GitHub repo, skill, plugin or MCP server, or an npm or PyPI package, and we read its code without running it. Check one now
Early AI-dopters members get 10 Pulse scans a month on 2 sites, VIP members 20 on 3 sites, plus free months of Deep. Claim it from the Lockpick tile in EA Apps.
Need more sites, a team or invoices? Talk to us
What's the difference?
Pulse and Deep side by side. Every plan includes Pulse.
| Pulse | Deep | |
|---|---|---|
| In plain words | A quick outside look, the way a stranger or a bot sees your site | A careful walk through your site, the way a determined attacker would |
| What we look at | The homepage and the files it loads, email sender settings (SPF and DMARC), security headers and TLS, and public DNS, certificate and subdomain records, in at most 12 requests. It also checks whether two files that should never be public, /.env and /.git/HEAD, can be downloaded. | Up to 30 readable pages and 20 scripts, files that should not be public, admin areas, and your API if you have one. If your site builds its pages in the browser, the report says how much Deep could read. |
| How long | Usually under 15 seconds | 2 to 8 minutes |
| Needs proof you own it | No, just confirm you're allowed | Yes, a DNS record, a meta tag or a file, kept published |
Neither one changes anything on your site. Master Key signs in to your app with two test accounts to check whether one user can see another user's data. Coming soon.
Questions
Is it safe to scan my site?
Yes. Scans only read what your site already shows the public, with a small, paced number of requests, at most 12 for a Pulse and 200 for a Deep scan. They never sign in, submit forms or change anything.
Do I need to be technical?
No. Every report says what we found in plain words and what someone could do with it. Each finding comes with a fix prompt you can paste into your coding assistant, and Check again tells you when it's fixed.
Do you look at my code?
Website scans never do. They only look at what anyone on the internet can see. Repo and skill checks read the public code of a GitHub link you paste and never run it.
Pulse or Deep, which do I need?
Start with Pulse, a quick outside look at your homepage, email and security settings and public records. Choose Deep when you want us to walk through the whole site, up to 30 pages and your API, the way a determined attacker would. Deep needs proof that you own the site, a DNS record, a meta tag or a file, kept published.
What uses a scan?
Every Pulse or Deep scan uses one scan from the month's allowance. That includes Check again, auto-checks and scans your AI starts. Only the daily Pulse auto-checks on Deep and Master Key are included and don't count. A quick check, Re-read this record and reading your results are free, and a scan that fails or that your site blocks doesn't count. When the month's scans run out, auto-checks wait for the reset and email you.
What counts as a site?
One domain with all of its subdomains, so www and app count once. Free covers one site and Deep covers 10 sites. Teams and agencies get as many as they need.
How many people can use a plan?
Free includes 1 seat and Deep includes 3 seats. Teams and agencies get unlimited seats in one shared workspace.
Do Early AI-dopters members get anything extra?
Yes. Members get 10 Pulse scans a month on 2 sites and a free month of Deep. VIP members get 20 Pulse scans a month on 3 sites and 2 free months of Deep. Claim it from the Lockpick tile in EA Apps.
Will auto-checks slow down my site?
No. An auto-check sends the same small, paced requests as a scan you start yourself, at most 12 for a Pulse and 200 for a Deep scan, no more than once a day.
Can I cancel any time?
Yes. Cancel from Billing, which opens Polar, our merchant of record. Your plan runs to the end of the period you paid for, then your workspace moves to the Free plan. Your sites, reports and history stay, and you can subscribe again whenever you like.
Do I get invoices?
Yes. Polar, our merchant of record, sells paid plans and emails a receipt for every payment. Billing in Lockpick opens Polar's portal, where you download invoices, change your card or cancel.
What do you store?
Your account, your sites and the reports we produce for them, with evidence kept in redacted form. We never store your code, your visitors' data or anything behind a login. The privacy policy has the details.
See what your site shows first
Start with a free look at your homepage, then pick how far to go.