Included
$0
forever
Choose this ifDevelopers who want to verify AbyssGuard's signal before paying.
The primary starter path: paste a public GitHub repo, get a quick safety preview, then upgrade only when private code or saved reports need coverage.
Free tier included
The free tier proves AbyssGuard's signal on a public repository. Builder is the natural upgrade when you need private repos, weekly monitoring, managed GitHub App PR checks, saved reports, repair packets, and verification rescans.
Which plan should I choose?
Free
Run the free public-repo preview first. It should prove AbyssGuard catches real product risk before checkout or private-source setup.
Saved Report
Buy one saved evidence-backed review when a launch, client handoff, or funding conversation needs proof.
Starter
Use Starter for one maintained repo when you need core AppSec coverage, included PR-check model, and generous manual saved deep reviews before scheduled monitoring.
Builder
The default for serious SaaS founders who need up to 5 private repos, weekly monitoring, saved reports, repair packets, and fix verification.
Studio
Use Studio for agency, client, 15-repo, export, and priority workflows - not because Builder is incomplete.
1 repo
$29
/mo
Generous manual saved deep reviews for one repo you actively maintain. Scheduled calendar scans start on Builder.
Best for founders
$99
$59
/mo
Default for serious SaaS founders: weekly monitoring, saved evidence, repair packets, and verification for up to 5 repositories.
Best for agencies
$199
$149
/mo
Agency, client, 15-repo, export, and priority workflow for teams managing several products or client handoffs.
Private repo trust posture
GitHub App access is read-only, limited to selected repositories, revocable anytime, and used only to build reports. Raw source is discarded after report generation; AbyssGuard retains findings, evidence paths, and summaries - not your code - and never uses your source for model training.
✓ See findings before paying ✓ Cancel anytime ✓ Read-only GitHub App ✓ No code stored
AbyssGuard Studios keeps expanding the cybersecurity method catalog as new attack patterns, AI-code failure modes, framework risks, and payment/auth issues appear. Your reviews improve as the method library grows.
One-time saved reports
Start here
$0
public repos
Choose this ifTesting a public repo with almost no friction.
Public preview, no saved deep report. Use it to see whether AbyssGuard catches real risk in your repo before signup, private-source setup, or payment.
Pay once
$149
$99
one-time
Choose this ifOne serious repo gut-check before a launch, client handoff, or funding conversation.
One saved deep review for one repository when you want evidence and a fix plan without ongoing monitoring.
What you're actually getting
Manual security review takes 10-20 hours. AbyssGuard does it in minutes with file-level evidence.
Developers shipping with Cursor, Copilot, and Claude Code use AbyssGuard to catch what AI tools miss.
Weekly monitoring compares against your baseline. New bugs surface before users find them.
One breach costs $200K+ in cleanup, legal, and lost trust. AbyssGuard is your early warning system.
When scheduled monitoring or PR-check workflows find issues, you get an email with every actionable finding - file, line, severity, and fix direction. No manual checking.
Full value inventory
AbyssGuard currently tracks 41 security healthcheck areas across application, identity, platform, operations, and specialist security scope. 29 are automated now, 32 are eligible for recurring monitoring, and the rest are labeled clearly so you know what is evidence-backed versus specialist/manual scope.
41
Healthcheck areas
29
Automated now
32
Monitorable areas
5
Framework references
List view, not tag soup: category sections stay evenly distributed across the page instead of piling every label into one right-side wall.
Why pay before it hurts?
Sample report
The demo uses an intentionally vulnerable sample AI SaaS so buyers can inspect the exact evidence, fix direction, AI-agent prompt, and verification workflow before spending money.
Every strong finding leads with the affected file, line, and location summary so the report feels concrete.
Findings explain the observed proof and the product-risk story instead of dropping a generic scanner label.
Full reports pair findings with practical repair direction written for a human dev, Cursor, or Claude Code.
Each serious finding gets a concrete re-check step and a targeted verification case when the plan includes it.
Reports separate confirmed evidence from needs-manual-review cases so buyers know what is proven versus what needs confirmation.
Monitoring delivery
MVP note: automated scanning and report comparison are the product path. Until every recurring worker is fully hardened, some early monitoring fulfillment may include manual/concierge scheduling and review by AbyssGuard operations.
Run the first paid deep review immediately. That saved baseline becomes the comparison point for future monitoring runs: files, findings, severity, evidence, and repair state.
Deep reviews run when the buyer needs saved evidence. Starter remains manual. Builder adds a weekly calendar slot you choose. Studio adds daily or weekly calendar scans. Managed GitHub App PR checks use a lightweight fair-use model with native check runs and sticky PR summaries, while saved Deep Reviews remain the full report allowance. When a scan finishes, you receive an email alert listing every actionable finding with file, line, severity, and fix direction - no need to check the app manually.
AbyssGuard highlights new findings, repeated findings, resolved findings, and regressions against the previous baseline so the report feels alive month to month.
A verification case is issue-scoped: pick one original finding, apply your patch, then AbyssGuard re-runs checks for that same issue with capped attempts.
Risk-free
Run a free scan on any public repo. If AbyssGuard catches real risk, you'll know exactly what you're paying for before checkout.
Private source handling
Terms
A lightweight public-repo scan that shows urgent signals before payment.
A saved evidence-backed report with file-level findings, confidence, and fix order.
A lightweight branch or pull-request guardrail included with paid plans under fair-use protection.
Implementation guidance and an AI-agent prompt for one serious finding.
A bounded re-check to see whether a specific finding was fixed.
AppSec platform coverage
This is the honest enterprise-grade map: what AbyssGuard already automates, what is partially covered through reports and operations, and what needs a dedicated product sprint before it should be sold as self-serve.
Managed GitHub App PR checks, sticky PR summaries, saved evidence reports, SAST/SCA/secrets/IaC categories, repair packets, verification cases, and source-discard privacy posture.
Custom CI/CD, account onboarding, volume pricing, and client/agency workflows can be handled as Studio or concierge scope while self-serve automation matures.
Packaged CLI, IDE plugins, SAML/SCIM, deep RBAC, Jira/Slack native apps, non-GitHub SCMs, on-prem deployment, and custom rule UI still need dedicated releases.
Comparison
| Feature | Free | Saved report | Starter | Builder ⭐ | Studio |
|---|---|---|---|---|---|
| Price | $0 | $99 | $29/mo | $59/mo | $149/mo |
| Plan type | Free preview | One-time saved report | Subscription | Subscription | Subscription |
| Best for | Checking signal | One repo gut-check | One core repo | Serious builders | Agencies / client repos |
| Repository allowance | Public preview | One saved deep review | 1 repo | 5 repos | 15 repos |
| Public quick checks | 1 anonymous free scan | Not included | 250 public quick checks / month | 1000 public quick checks / month | 5000 public quick checks / month |
| Deep repo safety reviews | Preview only | 1 saved deep repo review included | 20 deep repo safety reviews / month | 100 deep repo safety reviews / month | 500 deep repo safety reviews / month |
| Scheduled calendar scans | Locked | Locked | Locked - manual scans only | Weekly slot you choose | Daily or weekly slot + priority queue |
| PR checks | Locked | Locked | Managed GitHub App checks + sticky summaries | Managed GitHub App checks + sticky summaries | Managed checks + sticky summaries + priority queue |
| Error email alerts | No | No | No | Email alerts when scans find errors | Instant alerts for every actionable finding |
| What gets compared | Current public files only | Single repo scan | New findings vs prior baseline | Baseline, regressions, and fix attempts | Client/app baselines across multiple repos |
| Methods | Preview signal | Builder-grade one-time coverage | Core production-risk coverage | Expanded SaaS/product-security coverage | Full advanced 754-method catalog |
| Verification rescans | No | Targeted verification rescan included (3 attempts for the same finding) | Monthly targeted verification rescan allowance (3 attempts each) | Monthly targeted verification rescan allowance (3 attempts each) | Monthly targeted verification rescan allowance (5 attempts each) |
| Saved-scan findings | Limited | All | Current + future reports | Current + future reports | Current + future reports |
| Report retention | Session only | 90 days | 30-day previews / 90-day paid reports | 30/90 days + archive important reports | 30/90 days + archive important reports |
| Archive | No | No | No | Included | Included |
| Repair support | No | Rule-backed code-change suggestions, repair prompt, one Repair Packet per finding, and 3 verification attempts for the same finding | Rule-backed suggested fixes for high-risk findings; 3 verification attempts for the same finding | Generous monthly Repair Packet allowance, patch-outline prompts, manual failed-verification regeneration, and verification checklist | High-volume Repair Packet allowance, client-safe summaries, manual failed-verification regeneration, and export-ready verification notes |
| Repair packets | No | AI repair packet per finding | Rule-backed repair guidance | Monthly AI repair packet allowance | Monthly AI repair packet allowance |
Verification rescans mean AbyssGuard re-runs the scanner after a buyer applies fixes; they are not a human certification or penetration test. Repair Packets are available on Builder and above, matched to the monthly deep-review workflow, and used for patch outlines rather than automatic code edits until that path is verified.
AI coding tools are incredible at generating code fast — but they don't know your business rules. They write auth code without knowing who should have access, payment code without server-side pricing, webhook handlers without signature verification. AbyssGuard catches what your AI can't know — the gap between generated code and safe production code.
You could — if you had time to read every line your AI generates. But AI-assisted teams ship 10x faster, and manual review hasn't scaled to match. AbyssGuard catches the patterns AI tools consistently get wrong so you can focus your review on the business logic only you understand.
That's actually good news — your repository is cleaner than most. But the free scan uses preview methods only. Paid plans unlock the full catalog with deeper auth, payment, and data-flow checks that catch issues preview methods can't reach.
Yes. AbyssGuard now detects React Native, Expo, Flutter, Android, iOS, and Capacitor source and checks source-visible mobile risks such as insecure token storage, cleartext traffic, broad iOS ATS exceptions, risky WebView settings, sensitive Android permissions, and mobile API endpoint exposure. APK/IPA reverse engineering stays a separate paid or specialist path.
Yes. AbyssGuard includes automated vulnerability scanning with built-in rules and optional open-source scanners for SAST, SCA/dependencies, secrets, IaC, containers, SBOM, passive live URL checks, Nuclei, OWASP ZAP, and AI-generated-code guardrails when explicitly authorized. It is not marketed as a penetration test or certification.
Yes. Upgrade instantly and your current month's plan allowance carries over. Downgrade at the end of your billing cycle. Yearly plans can switch to monthly after the year ends.
Monitoring stops — your repository keeps changing and we stop watching it. Historical reports remain accessible for their retention period, but scheduled scans and scan-on-commit stop. Most builders stay on because AI-generated code keeps accumulating.
No. Your source code is treated as temporary scan input — we analyze it, extract findings, and discard the source. AbyssGuard stores only the normalized report data (file paths, severity, finding descriptions) so you can review results without turning your codebase into our database.
No. AbyssGuard is automated vulnerability scanning and static/source analysis with deterministic rules and optional open-source tools. It catches known dangerous patterns in AI-generated and human-written code. Penetration testing involves active exploitation and remains a separate, explicitly authorized service. Use AbyssGuard for continuous monitoring, pen tests for final validation.
Builder covers 5 repositories with scheduled deep reviews, implementation-ready repair packets, targeted verification rescans, and the included PR-check model. Most serious builders maintain several active projects and need the weekly monitoring rhythm that Starter can't provide.
Run the free scan, inspect the proof, then choose the monitoring tier that matches your repo risk.
