I'll point our security scanner at your app and send you whatever it finds, free

Syef here, one half of a two-person security startup. We built a thing that looks at a web app from the outside the way an attacker would, and the one rule we hold to is that it only calls a finding PROVEN when it can actually prove it. Everything else gets labelled refuted, inconclusive or not tested, because a list of maybes helps nobody. Right now we need real apps pointed at it more than we need anything else. So: drop a domain you own or are authorised to test, and I'll send you what we find. Including "nothing", if that's the honest answer. External only, nothing to install, no account, no call, and no follow-up pitch unless you ask for one. What I'd like back is where the report was useless to you. That's worth more to us than a thank you.