Opportunities › AI coding assistant for security testing › Proposed app
Pickset
AI pair-programmer for authorized security testing on code you own
- Score
- 6
- confidence 28
- Evidence
- 3
- items on the page
- Rivals
- 2
- named in sources
- First version
- 35 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2021
- Emerging market · AI estimate
ScreensConcept
Desktop app: Security analysis of codebases with vulnerability review, proof-of-concept drafting, and audit logs is intensive technical work done during focused coding sessions. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
New Session
Scope confirmed- Repository
About this appAI proposal
Pickset is an AI coding assistant built for security work on your own codebase. Connect a repository your organization owns, and it helps find vulnerabilities, explain how they could be exploited, and draft proof-of-concept code so the people who need to fix the issue can see exactly what is wrong.
It is for enterprise security teams and developers who today paste analysis between a general coding assistant and a separate chat tool just to get a usable exploit sketch, because their primary assistant refuses the request outright. Pickset assumes the work is defensive and scoped to repositories the account owns, and does not require that workaround.
Every session is tied to a declared scope and produces a written record: what was asked, what was found, and what proof-of-concept was generated. That record is meant to drop straight into a bug report or a ticket, instead of being reconstructed by hand after the fact.
- Tagline
- An AI coding assistant that helps you test your own locks, on the record.
- Voice
- DirectPreciseCalmTrustworthy
- Why this name
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Scoped repository access
Each session is tied to a specific repository and branch your org owns, set up once by an admin, so the assistant always knows what is in bounds.
No member yet
Vulnerability analysis on request
Ask about an endpoint, function, or dependency and get a plain explanation of how it could be misused, with references to the exact lines involved.
No member yet
Proof-of-concept exploit drafting
Generates runnable PoC code for the vulnerability it found, in the same language as your project, so a reviewer can confirm the issue without writing it themselves.
No member yet
Bug-report export
Turns a session's findings and PoC into a formatted write-up for Jira, GitHub Issues, or a plain markdown file, ready to attach to a ticket.
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#14201FDeep Ink · text#F4F1EAPaper · surface#0F6B63Signal Teal · primary#D98A1FAmber Flag · accent#B2432FBrick · data: high severity#5E8B4FMoss · data: fixed
Typography
Aa
Pickset
PricingAI proposal
The material states only that GitHub Copilot Enterprise is a paid tier with no quoted figure; these tiers are a starting point to test, not matched to any disclosed price.
Team
$39 a month
- Per seat, billed annually
- Up to 10 repositories
- Standard session audit log
- Jira and GitHub export
Enterprise
Contact us
- Unlimited repositories
- SSO and role-based scope controls
- Extended audit retention
- Dedicated onboarding
Would you pay Team · $39 a month?
Your answer tells PWAS which prices people accept. It changes no score.
No answers yet.
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- No loop in the product. The product works on private, owned repositories and produces internal bug reports; there is no natural path for one user's session to be seen by people outside their own security team.
- Do they become customers?
- Exported reports go into internal trackers like Jira, not to outside parties, so they create no outside exposure; growth would depend on direct sales and content, not product-driven sharing.
- First customers
- Security engineers or application security leads at mid-size software companies who already pay for GitHub Copilot Enterprise and have hit its refusal on a real ticket.
- Where to reach them
- Security engineering communities: Share the workaround problem and the tool in forums and Slack groups where appsec engineers already discuss tooling gaps, such as niche subreddits and Discord servers for AppSec.
- Direct outreach to security leads: Identify companies with active bug bounty or internal pentest programs via job postings for AppSec roles, and reach out directly to the hiring team or lead.
- Conference talks and write-ups: Publish a concrete account of the Copilot-to-Microsoft-365 workaround and demo the alternative at small AppSec meetups or BSides-style events.
- First milestone
- Five paying security teams running real scoped sessions against their own repositories within the first three months.
Why people already pay for this
- AI inferenceEnterprise developers pay for AI coding assistants but face restrictions that prevent legitimate security testing work on proprietary code
- AI inferenceThe restriction causes enough frustration to motivate developers to use workarounds with multiple tools
- AI inferenceThere is demand for AI assistance that enables rather than blocks security testing workflows
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Code execution sandboxIsolated container runtime (e.g. Firecracker-based)Proof-of-concept exploits must run against test fixtures in a disposable, network-restricted environment, not on shared infrastructure.
- This app · Source control integrationGitHub/GitLab OAuth app with repo-scoped tokens
RisksAI inference
- AIThe model may refuse or soften outputs inconsistently, or generate exploit code that does not actually reproduce the vulnerability, undermining trust in the PoC.
- RegulatoryEven scoped to owned repositories, generating working exploit code raises liability questions if credentials leak, scope is misconfigured, or output is reused outside the intended target.
- PlatformUnderlying LLM providers could tighten their own usage policies on exploit generation, cutting off the model access this product depends on.
- CommercialGitHub Copilot Enterprise or Microsoft could simply loosen their own restrictions for verified enterprise security teams, removing the gap this product fills.
- DataStoring proprietary source code and generated exploits creates a high-value target; a single breach would be far more damaging than for a typical coding assistant.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.