People, real devices and controlled agents test your site, app or service — security first. A senior reviewer signs the card: every finding in plain language, a fix plan attached.
API & auth abuse paths
Cloud config reviewReal devices, real networksAgents under human reviewWritten consent, always72-hour report cardSigned by a senior reviewerThe subjects
Security is graded first because a miss there costs most. The same four subjects every time, so one release can be read against the last.
Subject 01
Subject 02
Subject 03
Subject 04
The graders
People find confusion. Devices find breakage. Agents cover the rest. A reviewer decides what makes the card.
Real people, paid fairly, matched to your actual audience — from first-time users to domain experts.
Every level of capability, from smoke-test bots to deep-reasoning agents that explore like curious users.
The phones your users actually hold, on real networks — not an emulated lab in one data center.
A separate contract, not included by default: a deeper third-party security test, then hands-on help with the fixes. Scoped in writing. Nothing starts until you sign.
Security — sample findings
Four illustrative findings, written the way yours will arrive: what we found, where it sits, how serious, what to do next. Plain language, same as the rest of the card. The Retest Cybersecurity contract goes deeper, with your written consent.
Every finding becomes a line on your report cardsee the sample
The proof
Every finding on the card carries the evidence behind it. A senior reviewer signs the card. You can check.
Each finding names where it sits and what we saw. Found by agent, confirmed by hand.
A screenshot of the screen where it happened. A screen record of the steps that got there. The request and the response beside them.
You don't translate the finding into a ticket. The fix plan comes attached.
A person's name sits on the call that a finding is real. Not a tool's confidence score.
Honesty
A fair case names its limits. Here are ours.
A flow can pass every check and still confuse the person holding the phone. That is why a person signs the card.
If you need a certificate for an auditor, you need an accredited audit. A report card tells you what to fix. It does not certify you.
A report card reads the release your customers are about to meet. If nothing ships this quarter, wait.
The deliverable
Four subjects on the front, the fix plan on the back, one signature under it. Turn it over.
Two B's stand between this and an A product. — R.A.
Three security findings stay open — fix plans on the back. PASS grades the whole card.
whole cardFront — the marks
Illustrative sampleThe product, marks and findings on this card are invented to show the format.
Read the whole sample reportStart here
A URL, an email and one choice. The scope comes back in writing before anything runs.
Staging by default. Never put a password in this brief.
Add your product’s URL to continue.
The next page asks for your name and email, then sends the brief. This site takes no payment and asks for no card.
retest.asia
Four subjects. Security first.
