AI QA Monkey
AI Security Intelligence
Premium report tour

Here's exactly what your $29 unlocks

A complete walkthrough of every dashboard section, every export format, and every AI tool integration — so you know precisely what arrives in your inbox.

$1,500+ consultant rate $29 one-time · instant
Start your free scan See the report tour
12 Dashboard sections
100+ Security checks
3 Export formats
~60s Scan duration
Inside the dashboard

Twelve sections. One unified view of your security.

Each section delivers a different layer of analysis. Together they form a complete penetration-test-grade audit.

Overall Security Score Risk: High
62
out of 100
0–49 Critical 50–74 Warning 100+ Healthy
01 · Score

Security Score Gauge

A weighted 0–100 score across SSL, headers, ports, file leaks, DNS, GDPR, and tech fingerprinting. Updated in real-time as remediation lands — so you can watch your score climb after applying our fixes.

  • Weighted scoring across 7 categories
  • Color-coded severity bands
  • Re-scan free for 30 days post-purchase
Findings by Severity 27 total
Critical
3
High
7
Medium
12
Low
5
02 · Distribution

Severity Distribution Chart

Triage at a glance. See where every finding lands on the Critical → High → Medium → Low spectrum, so you know exactly what to fix first.

  • OWASP-aligned severity classification
  • Sortable by impact, exploitability, and effort
  • Filter to focus on just one band
Vulnerability Table 3 critical
SeverityIssueFix
Critical Exposed .env file Copy fix
High Missing CSP header Copy fix
Medium Cookie missing HttpOnly Copy fix
Low Server header leaks version Copy fix
03 · Findings

Vulnerability Table

Every issue, ranked by severity, with a one-click Copy Fix button for the exact remediation snippet. Filter, sort, export — built for fast triage.

  • One-click copy of remediation code
  • Direct OWASP / CWE / CVE references
  • Evidence packet attached to each finding
Kill Chain Attacker's view

Exposed Assets

  • api.example-shop.com
  • staging.example-shop.com
  • cdn-uploads/

File Leaks

  • /.env 200 OK
  • /.git/HEAD 200 OK
  • /backup.zip 403

Compliance

  • OWASP A05 Fail
  • PCI 6.4.1 Fail
  • ISO A.8.23 Partial
04 · Kill chain

Kill Chain Analysis

The exact reconnaissance path an attacker would take against your site. Exposed assets, leaked files, and broken compliance controls — surfaced before they're exploited.

  • Real attacker reconnaissance methodology
  • HTTP evidence for every leaked path
  • Cross-referenced to compliance frameworks
Attack Surface Map Visual
Healthy Warning Exposed
05 · Surface

Attack Surface Map

An interactive visual of every endpoint, subdomain, and exposed path connected to your root domain. Color-coded so risks pop instantly.

  • Subdomain discovery + takeover risk detection
  • API endpoint enumeration (Swagger / GraphQL / OpenAPI)
  • Cloud storage exposure check (S3 / Azure / GCS)
Compliance Mapping OWASP · PCI · ISO
OWASP Top 105 / 10 triggered
PCI DSS v4.03 controls flagged
ISO 27001 Annex AA.8 / A.13 aligned
06 · Compliance

Compliance Mapping

Each finding cross-referenced against OWASP Top 10, PCI DSS v4.0, and ISO 27001 Annex A — so audit prep is built into your scan, not a separate workstream.

  • OWASP Top 10 (2021) category alignment
  • PCI DSS v4.0 control mapping
  • ISO 27001 Annex A reference
Copy-Paste Fix Apache · Nginx · PHP
.htaccess 
<FilesMatch "^\.(env|git|htaccess)$">
    Require all denied
</FilesMatch>

Header set Content-Security-Policy \
  "default-src 'self'; script-src 'self' 'nonce-RND';"
Header set X-Frame-Options "SAMEORIGIN"
07 · Fixes

Copy-Paste Fix Commands

Every finding ships with a production-ready remediation snippet for Apache, Nginx, PHP, Node.js, or whatever your stack runs. No translation needed — just paste and deploy.

  • Server-specific configurations (Apache, Nginx, IIS)
  • Framework-specific examples (Laravel, Django, Express)
  • Tested against real attack vectors
AI Fix Prompt Paste anywhere

"My PHP session cookie is missing HttpOnly, Secure, and SameSite=Lax flags. Show me the exact session_set_cookie_params() call I should add to my bootstrap to enforce all three across every session cookie."

Ready for: ChatGPT Claude Cursor Windsurf
08 · AI Prompts

AI Fix Prompts

Every finding comes with a pre-written prompt engineered for ChatGPT, Claude, Cursor, Windsurf, GitHub Copilot, and Gemini. Paste it in your AI tool of choice — get a tailored fix for your stack in seconds.

  • One prompt per finding — copy & paste
  • Engineered for the latest AI coding models
  • Context-aware: knows your finding, severity, evidence
Executive Summary PDF + email
Targetexample-shop.com
Scan duration58 seconds
Total findings27 (3 critical, 7 high)
Score62 / 100 — High Risk

Your site exposes a critical configuration leak (.env) and lacks fundamental browser protections (CSP, X-Frame-Options). Estimated remediation effort: 2–4 hours with the provided copy-paste fixes.

09 · Summary

Executive Summary

A non-technical recap your CTO, CEO, or client can read in 90 seconds. Score, key findings, estimated remediation effort, business impact — all in plain English.

  • Plain-English risk language
  • Estimated remediation effort in hours
  • Business-impact framing
Trend & Confidence +18 since last scan
Confidence96.4%
Scans5 in 30 days
SLA hit4 of 5
10 · Trend

Trend & Confidence Score

Track your score over time as you ship fixes. Each scan logs to your account so you can see exactly how every release moves your security posture.

  • Score timeline across all rescans
  • Per-finding confidence rating (96%+)
  • Detection SLA tracking
Evidence Mode HTTP signals captured
HTTP status200 OK
Server headernginx/1.24.0 (Ubuntu)
Page titleExample Shop — Buy online
TLS versionTLSv1.3
CSP headerMissing
HSTSMissing
11 · Evidence

Evidence Mode

Every HTTP response captured during the scan — server headers, TLS version, security headers, page title. Forensic-grade evidence you can show your team or auditor.

  • Full HTTP response evidence per finding
  • TLS chain inspection & cipher details
  • Header-by-header diff against best practice
Export Formats PDF · JSON · CSV
PDFExecutive-ready
JSONCI / CD pipeline
CSVExcel / sheets
12 · Export

Three Export Formats

Hand the PDF to your CEO, pipe the JSON into your CI pipeline, drop the CSV into your ticketing tool. One scan, three ways to share.

  • Branded PDF (your logo on every page)
  • Machine-readable JSON for automation
  • Per-finding CSV for ticketing systems
For every skill level

Never guess how to fix it

A finding is only useful if you can act on it. Every issue we surface comes with three ways to fix it — so no result is ever a dead end, whether you're a senior engineer or you've never touched a server config.

  • Copy-paste config

    Production-ready Apache / Nginx / framework snippets — for engineers who just want to paste and deploy.

  • AI fix prompt

    A pre-written prompt for ChatGPT, Claude, Cursor or Copilot that returns a fix tailored to your exact stack.

  • Step-by-step written guide FOR NON-EXPERTS

    A plain-English walkthrough for every finding — what it means, why it matters, and exactly what to click. No jargon, no assumptions.

A guide library that keeps growing

45+ guides
Fix exposed .env files Fix CORS misconfiguration Add the right security headers Fix SSL / TLS certificate errors Stop email spoofing (SPF/DKIM/DMARC) Prevent subdomain takeover
Browse all 45 security guides
New · Always on

We don't just scan once. We watch your score every day.

Turn on continuous monitoring and AI QA Monkey re-scans your site on a schedule, charts your security score and open vulnerabilities over time, and emails you the moment anything slips — so a regression never goes unnoticed. Included free for 30 days with your report, or ongoing on any monitoring plan.

yoursite.com
Monitored continuously · 8-week history
Monitoring on Email alerts
90Security score now
0Open critical issues
+29Points recovered
Security score rising while vulnerabilities fall over eight weeks The security score climbs from 61 to 90 as open vulnerabilities drop from 14 to zero. A monitoring alert was sent in week 5 when the score dipped. 50 70 90 100 alert sent w1w2w3w4w5w6w7w8
Security score Open vulnerabilities Monitoring alert

Scheduled re-scans

We re-run the full 100+ check audit on your schedule — daily or weekly — with zero effort from you.

Instant drift alerts

The moment your score drops or a new vulnerability appears, you get an email — before an attacker finds it.

Score & vulnerability history

Every scan is saved to a live timeline, so you can prove your security posture is improving over time.

Branded PDF export

A boardroom-ready PDF, generated in one click.

Every premium scan produces a multi-page PDF you can attach to a client email, drop into a SOC 2 evidence folder, or hand to your CEO. Optionally branded with your client's logo.

Appendix · Evidence
Findings & Fixes
Critical Exposed .env file
High Missing CSP header
Medium Cookie missing HttpOnly
Security Audit Report
example-shop.com
62
Risk: High
Cover page with score Domain + executive summary on page 1
Detailed findings One finding per block, severity-color stripe
Embedded fix snippets Copy-paste code, syntax-highlighted
OWASP / PCI / ISO refs Audit-ready compliance mapping
Evidence appendix Full HTTP response captures
Custom branding Upload client logo, white-label ready
Universal compatibility

Your fix prompts work in every AI coding tool

Each finding ships with a ready-to-paste prompt engineered for the AI coding assistant you already use — no API key, no integration, no learning curve.

G
ChatGPTOpenAI · GPT-4 / GPT-5
C
ClaudeAnthropic · Sonnet / Opus
⌘
CursorAI-native code editor
W
WindsurfCodeium · Cascade flows
▶
GitHub CopilotVS Code · JetBrains
✦
GeminiGoogle · 1.5 / 2.0
♥
LovableAI app builder
⚡
Bolt.newStackBlitz · AI builder
Brand names are referenced for compatibility purposes only. Your prompts are model-agnostic and work in any modern AI assistant — including future models we haven't tested yet.
Featured in

Reviewed by independent industry sources

External publications have evaluated AI QA Monkey on its merits — here's what they wrote.

A powerful and practical security tool, offering deep automated scans with clear, actionable insights. The 'Copy Fix' feature and AI-driven prompts make remediation much easier, even for non-experts.

An extremely convenient website security scanning tool. Its intuitive interface, severity graphs, and JSON/CSV downloads allow me to quickly understand and address vulnerabilities. For development teams and businesses, it's a powerful solution for maintaining comprehensive security.

A comprehensive solution to assess and enhance website security posture. The platform provides AI-generated code snippets for quick remediation — a valuable tool for proactive security management.

All quotes are excerpts from publicly available reviews. Click any source above to read the full review.
Plans & pricing

Protection that fits how you work

Start with a one-time audit, or stay protected with always-on monitoring. Every plan runs the same 100+ check engine — and that engine never stops growing.

Your checks never go stale. We add new detections continuously — as fresh CVEs, misconfigurations, and attack techniques emerge, they’re built into the engine automatically. Every scan tests your site against the latest threats, with nothing for you to install or update.
Start here · no signup

One-Time Security Report

Scan free in ~60 seconds and see your score. Pay once only if you want the full fix report — no account, no subscription, yours to keep forever.

  • Full 100+ check report
  • Interactive attack surface map
  • Copy-paste fixes + AI prompts
  • PDF · JSON · CSV exports
  • 30 days monitoring included
Consultant rate $1,500+
$29 one-time
Run a free scan → Free scan first — pay only if you want the report · 30-day money-back
Continuous protection

Stay protected — never get caught off guard

Always-on monitoring re-scans your site on your schedule and emails you the moment your score drops or a new critical vulnerability appears. Cancel anytime.

Monitor

Always-on early warning

$7.99 / month
Start monitoring
  • Daily or weekly automated re-scans, 1 domain
  • Email alerts on score drop or new critical
  • Score & vulnerability trend history
  • Always tested against newly-added checks
  • Report downloads not included
Most popular

Pro

Monitoring + reports in one

$29 / month
Go Pro
  • Everything in Monitor
  • Daily or weekly monitoring, 1 domain
  • Up to 30 full reports / month
  • PDF · JSON · CSV + AI fix prompts
  • Verified Secure badge for your site

Agency

For teams & client work

$79 / month
Scale up
  • Monitor up to 10 domains
  • Daily or weekly, per domain
  • Up to 30 reports per domain / month
  • Presentation-ready PDF exports
  • Priority support

All subscriptions are month-to-month — cancel anytime. One-time report is a single payment, no renewal. Prices in USD.

Ready when you are

Run your scan free. Decide if it's worth $29 after.

No credit card. No signup. The free scan reveals every finding by category — the $29 unlocks the full guide, copy-paste fixes, AI prompts, compliance mapping, and exports.

Start your free scan
30-day money-back guarantee Secure Gumroad checkout Free rescans for 30 days