Answers to the questions security teams ask first about Verdict Runtime: data handling, production testing, false positives, pricing and more.
Not if you self-host: the scanner runs in your environment and only results leave, if you choose to send them. With the hosted option, your code is deleted automatically within an hour of the scan, or immediately on request.
A hand-written, reviewed proof reproduced the issue against your running application, inside a sandbox whose network access is locked to your target. If it doesn't reproduce, it isn't called confirmed. It stays labelled with the evidence it does have.
We test only what your written scope names, and we recommend a staging environment. Live traffic, logged-in testing and anything that writes data each need their own explicit authorisation.
No. Scan, verify, pentest, fix and defend are independent. Start with a scan, or bring your existing scanner's results and use us only for proof and fixes.
No. Fixes arrive as a reviewable diff or pull request, and defense artifacts are generated for your team to review and deploy, starting in observe mode.
Per engagement, quoted up front: by the number of repositories and applications in scope, whether live and logged-in testing is needed, and whether you have AI features to test. The first assessment is free.
One repository, one report, no obligation: the findings, the evidence behind each one, the fixes we can prepare, and an honest note on what we couldn't check.