Is your app vulnerable?
10 questions based on the most common vulnerabilities we find across 400+ real security assessments. Takes 2 minutes.
What this assessment measures
The ten questions are drawn from the vulnerability classes that show up most often in real web assessments: broken access control, authentication weaknesses, injection, misconfiguration, and business-logic abuse. Each one maps to a control that either exists or does not — MFA on privileged paths, rate limiting on auth endpoints, audit logging, dependency hygiene, secrets handling. Your score is a rough map of where an attacker would look first.
Who should take it
Founders and engineering leads who suspect — but have never verified — how exposed their application is. If you are about to close an enterprise deal, raise a round, or ship into a regulated space, a two-minute read on your posture is worth more than a guess. It is also a fast way to build the internal case for a proper assessment when budget is the blocker.
What to do with the result
Treat a low score as a triage list, not a verdict. Work the missing baselines first — auth hardening, rate limits, logging — then verify the rest with real testing. A self-assessment finds the gaps you already half-knew about; a manual assessment finds the ones you did not. If the result stings, that is the point.
Self-assessment FAQ
How accurate is a self-assessment quiz?
It measures exposure, not exploitability — whether the controls that would stop the common attack paths are in place. It cannot prove a flaw exists, but it reliably flags the environments where one almost certainly does.
What does my score mean?
Lower scores mean more uncontrolled attack surface: missing MFA on admin paths, no rate limiting on auth, unreviewed third-party tokens. Each question maps to a finding class we verify during a real assessment.
Should I fix what the quiz flags before getting tested?
Yes — the flagged items are the cheap wins. Fixing them first means a paid assessment spends its time on the deep logic flaws instead of the baseline hygiene you could have handled yourself.
Is the quiz anonymous?
Answers never leave your browser — the scoring runs client-side. Nothing is sent to a server, logged, or stored.