Security testing that a real person actually did.
Bug Circuit exists to answer one uncomfortable question honestly: what can an attacker already do to your site? We show you what they see, tell you the truth about your critical bugs for free, and then put real security engineers on the job of finding, explaining, and fixing what matters.
What we believe
Humans, not just scanners
A scanner fires templates and hopes. A person who understands your app finds the bugs that actually matter. Every Bug Circuit assessment is done by hand.
Authorized testing, always
We never touch a domain until you have proven you own it and recorded your authorization. It is the law, and it is our promise.
Start with what attackers see
The free check maps your public attack surface with passive recon, then tells you plainly whether you have any critical bugs right now.
We fix it, then we watch it
On Signal we do not just hand you a list. We fix the high and critical issues and keep your app covered for months as you ship updates.
How it works
You enter a domain you own. We run passive reconnaissance — the same public sources an attacker uses, like certificate-transparency logs and DNS — to map your subdomains, technologies and email posture. None of it touches your servers.
To go further you prove the domain is yours and record an Authorization to Test. Then, depending on your plan, a security engineer audits the site by hand and writes up exactly what they find, how bad it is, and how to fix it. On Signal, we fix the high and critical issues for you and keep watch for months as you ship.
We are deliberately small and deliberately careful. We would rather do a handful of audits properly than spray automated noise at everyone.
Run a free critical-bug check on your domain.