Hi PH, I'm Syef. We built a scanner that only says PROVEN when it can prove it
Hey everyone. I'm Syef, co-founder and CEO of Xseth, based in Lyon. I run go-to-market, and my co-founder Oussema builds the engine.
What we do: Xseth looks at your web app from the outside, the way an attacker would. It maps what's exposed, narrows thousands of URLs down to the few worth testing, then validates each one. No install, no code access, no accounts. Just a domain you own.
The one rule we don't bend: a finding is only labelled PROVEN when a deterministic check confirms it. Never because an AI said so. Everything else is honestly labelled refuted, inconclusive, not tested or false positive. Today we validate broken access control (IDOR/BOLA, BFLA), auth bypass and SSRF.
Why I'm here: we're looking for a few beta users and design partners, free. You give us a domain you own, we scan it and send you everything we find, including "nothing" if it's nothing. Design partners also get a direct line to both founders and a real say in what we build next. No pitch attached.
Two questions for you, because I'd love to learn who's here:
A. What are you building right now?
B. Has anyone ever asked you to prove your app was secure? A customer, an investor, a security questionnaire?
Drop your answers below and I'll reply to everyone. And if you want the free scan, DM me or email benkriefsyef@xseth.com.
Replies
A. A song generator, solo: iOS and Android apps, a web site, and one backend they all share. B. Nobody has asked yet, which is exactly why the PROVEN rule appeals to me. The thing I worry about is the one your list starts with, broken access control. My database rules deny everything by default, every server function checks an attestation token, and credits can only be written by the server, never by the app. But that is me saying so, and I wrote the rules. An outside check that only says proven when it really is would be the honest version of that claim. Good luck with the beta.