You see it. For access-control bugs, the kind where one signed-in user can read another user's private data, ArgosX doesn't just describe the risk, it reproduces it: we authenticate a second, separate account and replay the exact request that pulls the first account's data. Then we play that scan back to you step by step over the real screenshots, ending on the confirmed finding and a one-paste fix. There's a replay of a real one on our home page. Proof you can watch is worth more than a warning you have to take on trust.

It's grading its own homework. The same model (or a sibling model) that wrote the code shares its blind spots. If it didn’t think about an empty state, a race condition, or a leaky Supabase rule while building, it usually won't spot the same gap while reviewing. ArgosX is a separate, independent AI that has run automated scans on more than 13,000 other apps and the failure patterns they share, patterns it never touched during your build, plus a human tester for the judgment calls no model makes well. Independence plus breadth is what catches what your builder can't see in its own work.

Short version: the free scan (Quick and Deep) never signs in to your app, so a test login isn't used there. Only the paid Pro and Human-Verified tiers sign in and test what's behind your login.

The free scan has two parts, both read-only. The instant check looks for keys leaked into your page source. The deep free scan then crawls what any visitor can reach, security headers, cookie and TLS settings, accessibility, SEO, broken links, whether a logged-out visitor can open pages they shouldn't, and whether any of your data is readable without signing in at all.

The paid tiers actually drive your app end-to-end, signing in, submitting ordinary forms and checking what really happened, and exercise the flows behind your login, which no free scan touches because driving a live app needs your authorization.

Quick (free): an instant check of what any visitor can reach: keys left in your page and bundles, whether your database answers without a login, and missing security headers. No sign-in, nothing clicked.

Deep (free): we open your site like a visitor would and walk up to 15 pages, checking security settings, cookies and certificates, accessibility, SEO, broken links, whether a logged-out stranger can open pages meant for members, and whether any of your data is readable without signing in. We also flag unfinished-looking content on those pages: leftover placeholder text (lorem ipsum, “coming soon”) and words run together by a missing space. Takes less than two minutes.

Pro ($49/mo): everything in Deep, plus we sign in with a test account you give us and use your app like a customer: navigating, filling forms, submitting them, and checking what really happened afterwards, plus whether one user can reach another's data. We never delete, pay, check out or send messages. A Pro AI scan typically runs 30–60 minutes, and up to 90 for a large app with a second sign-in role.

Human-Verified ($249/scan): everything in Pro, and then a person on our team works through the judgment calls no software makes well, hands-on and read-only: whether a flow makes sense, whether it feels trustworthy, what happens when a session expires.

Every report tells you what we checked and, just as importantly, what we couldn't reach and why.

Yes. After the automated pass, a person on our team works through UX and edge cases hands-on and confirms the flagged findings, the things that need human judgment, like whether something merely runs versus actually feels trustworthy.

Two different clocks, and it's worth separating them.

The scan itself: the quick free check is instant, the deep free scan takes less than two minutes, and a Pro AI scan typically runs 30–60 minutes, up to 90 for a large app with a second sign-in role, because we're genuinely driving it rather than reading it.

Then the wait for your report: we review Pro reports before releasing them, so they usually land within 24 hours, and Human-Verified adds a real tester's pass and usually lands within 48. You don't need to keep the tab open. We email you.

We tell you, on the report, instead of quietly scanning less. A Pro AI scan uses the test accounts you give us, and we try each sign-in several times before giving up. A login can fail for reasons that have nothing to do with your app, like a deploy landing mid-scan.

But if a role still won't sign in, everything behind that login goes untested, and the report says exactly which role we couldn't reach. This matters more than it sounds: a scan that quietly covers less looks identical to a clean result, and the score would drift for a reason you'd have no way to see. We'd rather show you a gap than a flattering number.

Yes, and it's worth doing. Give us a second test account, a seller alongside a buyer, say, or an admin alongside a member, and we sign in as both and test what each side can actually reach. Most of the interesting problems live at the boundary between two roles, and a single-account scan can't see them by definition. Each side's findings are labelled with the role they came from, so you know who is affected.

Yes, by handing us a session instead of a password. Since there is no email/password for us to type, you log in once in your own browser and give us that already-signed-in session to reuse.

It takes about 30 seconds: sign in to your app as normal, open your browser's developer tools (F12, or Cmd+Option+I on a Mac) and click the Console tab, then paste this one line and press Enter, which copies the session to your clipboard:

copy(JSON.stringify({url:location.href,cookies:document.cookie,localStorage:{...localStorage},sessionStorage:{...sessionStorage}}))

Send us the result (or paste it into the session box in your app's setup) and we do the rest.

Two things to know: the session is short-lived, so grab it close to when the scan runs, and the console capture can't read HttpOnly cookies, so if the signed-in scan comes back looking logged out we'll ask for a Playwright storage-state export instead. If your app also offers email/password, that's simpler and doesn't expire, so prefer it.

The free scan is read-only and needs no account or card, just an email to send the report to. Paid tests sign in and use your app like a real user, so they can create and change records: point us at a test account. They never delete, pay, check out, upload files or send messages.

Not necessarily. Once you've shipped fixes, a $29 AI re-check confirms what the AI found, without a second full price. A full human re-test is a new Human-Verified pass ($249).