Build fast. Validate continuously. Ship securely.
Continuous application security for SaaS teams, agencies and AI-native builders. Find what matters, prove it safely, fix it clearly.
Free plan · No credit card · Connect GitHub, scan a repo, get your free security report
Passive checks on any public site. A hashed PDF in minutes, no sign-up.
Odin Intelligence
Findings
Open
14
−3 this week
Critical & high
4
ranked by Odin
Verified
2
proven safely
- 92Invoice API returns another tenant’s invoiceTwo-user check · api.example.com Verified
- 81Stripe secret key committed to configSecrets · payments/config.ts:12
- 74Table profiles created without Row Level SecurityCode · migrations/0001_init.sql
- 58CORS reflects arbitrary origins with credentialsSurface · app.example.com Verified
- 41lodash 4.17.15: prototype pollutionDependencies · package-lock.json
- Secret scanning
- Dependency advisories
- Static analysis (SAST)
- Infrastructure as code
- Dockerfile hardening
- Attack surface
- API authorization (BOLA)
- Pull request checks
- Draft fix PRs
- Evidence-grade reports
How it works
From first commit to verified fix.
Connect once and your first report is minutes away. Heimdall then keeps watch on your cadence and every pull request, confirms real risk safely, and drafts the fix as a pull request you review.
- 01
Connect GitHub
Install the AlliedAS GitHub App on the repositories you choose. Read-only by default.
- 02
Scan your repository
Pick a repository and the first scan starts at once: secrets, dependencies, static analysis and infrastructure as code.
- 03
Get your free security report
A hashed report with every finding, where it is and how to fix it, in minutes. Then Heimdall keeps watch on your cadence and every pull request.
The platform
Everything you need. Nothing you don’t.
A focused platform for teams that ship fast. No agents to install, no noise to triage.
Odin Intelligence
Ranked by real risk, and it shows its work
Every finding gets a deterministic 0–100 score with the factors behind it. No black-box AI deciding what matters.
Pull request checks
Catch it before it merges
Deduplicated, quiet PR checks with optional merge gating.
Argus Surface Scan
Verified domains only
Prove ownership with DNS or a well-known file before anything active runs.
Athena Test Engine
Proof, not guesses
Bounded two-user checks confirm broken access control with a fixed number of GET requests.
Apollo Insights
Fixes as draft pull requests
Reviewable patches you merge yourself. Never auto-merged.
A pantheon of guardians, one module for each job
- Heimdall WatchContinuous monitoring: scheduled scans and pull-request checks
- Argus Surface ScanAttack-surface inventory: domains, TLS, headers, exposed paths, API inventory
- Athena Test EngineAuthorized, bounded, non-destructive safe verification of web apps and APIs
- Odin IntelligenceExplainable risk prioritization and deduplication
- Apollo InsightsVerified findings, remediation guidance, patch drafts and verify-fixed
- Themis ReportsEvidence, integrity-hashed reports and tamper-evident audit trails
- Janus GatewayAccess boundaries: authentication, RBAC, tenant isolation and API entry points
- Hecate VaultEncryption, secret references and scoped test credentials
- Mimir Knowledge LayerPreviewAI-assisted, constrained patch drafting. Advisory only, never policy
- Hermes QASoonBrowser QA of the live app: pages, links, forms, sign-up and test-mode checkout, with a bug report, planned
- Thor ShieldSoonRuntime protection and active blocking (WAF), planned
Trust by design
Security testing you can actually trust.
The rules are enforced in code by a deterministic policy engine. Not left to AI, and not left to chance.
Only what you own
Active checks run only against domains you verify, within scopes you approve.
Safe by design
Read-only, rate-limited, bounded requests. Nothing destructive, ever.
Evidence, minimized
Secrets masked before storage. Response bodies never kept. Evidence expires.
You stay in control
An instant kill switch, and a tamper-evident audit log of every action.
Pricing
Pick how often Heimdall watches.
Plans scale by cadence and by how deep validation may go. Every plan includes the same safety guarantees.
Early access: Starter, Pro and Business are free for now. Pick yours from Billing after you sign up.
Free Developer
Heimdall keeps a monthly watch over your first repos.
$0
Start free- Monthly repository scans
- Monthly attack-surface monitoring
- Passive checks only
- PR checks: secrets
- 2 users · 3 private repos · 1 verified domain
Starter
Weekly watch, monthly safe verification.
$55/month
or $550 billed yearly
Start free · early access- Weekly repository scans
- Weekly attack-surface monitoring
- Monthly safe active validation
- PR checks: secrets, dependencies, code & IaC
- 5 users · 15 private repos · 2 verified domains
- 2 verification credits / month
- Fix drafts opened as draft pull requests
- Recommended
Pro Secure Build
Daily watch, weekly safe verification, CI gates.
$155/month
or $1,550 billed yearly
Start free · early access- Daily repository scans
- Daily attack-surface monitoring
- Weekly safe active validation
- PR checks: secrets, dependencies, code & IaC (merge gating)
- 10 users · 50 private repos · 5 verified domains
- 10 verification credits / month
- Fix drafts opened as draft pull requests
Business Continuous Validate
Hourly surface watch, daily verification, two-user authorization checks.
$555/month
or $5,550 billed yearly
Start free · early access- Daily repository scans + on every push
- Hourly attack-surface monitoring
- Daily safe active validation
- PR checks: secrets, dependencies, code & IaC (merge gating)
- 30 users · 150 private repos · 25 verified domains
- 50 verification credits / month
- Two-user authorization (BOLA) verification
- Fix drafts opened as draft pull requests
EnterpriseOpens with card payments
Hourly repository and surface watch at the largest limits, by card or invoice.
$1,555/month
or $15,550 billed yearly
Start on Free- Hourly repository scans + on every push
- Hourly attack-surface monitoring
- Daily safe active validation
- PR checks: secrets, dependencies, code & IaC (merge gating)
- 1000 users · 5000 private repos · 500 verified domains
- 500 verification credits / month
- Two-user authorization (BOLA) verification
- Fix drafts opened as draft pull requests
QA on every deploy Coming soon
Browser agents test each deploy. $49 a month on Starter with 10 runs; Pro includes 20 runs, Business 60 and Enterprise 300. Extra runs are $5 each.
One-off reports
Bought once, for a site you have proved you own. They open with card payments in the app; until a part starts, you can cancel it for a full refund.
Advanced Report Coming soon
$99
Safe active verification of your site plus a full repository scan, in one hashed report.
Bug Report Coming soon
$149
Browser agents walk your app and report the bugs they can reproduce.
Launch Day Check Coming soon
$499
The Advanced Report and a full Bug Report on your launch build, with audits.
Attested Pentest Coming soon
$999
An automated penetration test of one app, with a public verification letter.
Free re-test within 90 days.
Engagements
Paid up front in the app, with no sales call. They open with card payments, and you can cancel for a full refund until the engagement starts.
Fortify Coming soon
$11,000
A fixed-price security engagement for one product, scoped through an intake form.
Launch Shield Coming soon
$27,500
A fixed-price security engagement around a product launch.
Fractional security lead Coming soon
$33,000
A part-time security lead for one quarter, prepaid.
Prices in USD. Active validation runs only against domains you verify and scopes you approve. Compliance mappings (SOC 2, HIPAA, FERPA) are on the roadmap.
FAQ
Questions, answered.
Is AlliedAS a penetration test?
AlliedAS is continuous, automated validation: static analysis of your code plus bounded, non-destructive checks against assets you prove you own. It complements a human-led penetration test and helps you prepare for one.
Will AlliedAS ever change my code?
Only if you ask. Apollo can open a draft pull request with a proposed fix; you review and merge it yourself. AlliedAS never auto-merges.
Can I scan a website I don’t own?
No. Active testing requires domain-ownership verification and an authorization attestation, enforced by a deterministic policy engine, not by AI.
Where does AI fit in?
Mimir (in preview) helps draft fixes. It never decides what gets tested and never executes anything.
What does AlliedAS scan?
Secrets, vulnerable dependencies (matched against the OSV advisory database), source code (SAST), infrastructure as code and Dockerfiles, your verified attack surface and, on higher plans, broken object-level authorization with dedicated test accounts. Container image scanning is coming soon.
How much does AlliedAS cost?
There is a free plan with monthly scans. Paid plans are $55, $155, $555 and $1,555 per month, or ten months’ price per year, scaling from weekly to hourly repository scans, with hourly attack-surface monitoring from Business up. During early access, Starter, Pro and Business are free; Enterprise opens with card payments.
Let Heimdall stand watch.
Connect a repository and see your first findings in minutes. Free to start.