Opportunities › AI-powered vulnerability detection and remediation › Proposed app
Plainproof
Find, confirm and fix code vulnerabilities, with proof for every finding
- Score
- 48
- confidence 61
- Evidence
- 11
- items on the page
- Rivals
- 4
- named in sources
- First version
- 45 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2003
- Mature market · AI estimate
ScreensConcept
Desktop app: Security engineers triage verified vulnerabilities, review evidence, draft fixes, and manage continuous re-checks in focused work sessions at a desk. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Confirmed findings
Last scan 12 min ago7
About this appAI proposal
Plainproof is a security workspace for small application security teams. It connects to your repositories, runs static analysis and fuzzing, and then tries to reproduce each finding before it reaches you. What you see is a short list of confirmed issues, each with the evidence behind it.
For each confirmed issue, an AI agent drafts a fix as a pull request with a test that fails before the patch and passes after it. You review and merge. Nothing is changed without a person approving it.
It is built for DevSecOps engineers and security researchers who are tired of triaging noisy scanner output by hand. It does not replace a penetration tester; it clears the routine work so they can spend time on hard problems.
- Tagline
- Findings you can trust, with fixes ready to review.
- Voice
- PreciseCalmDirect
- Why this name
- Plain proof is what a finding needs: evidence anyone can read. Two plain words, easy to say, and it names the promise of no unconfirmed alerts.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Verified findings only
Each candidate issue is replayed in a sandbox. Findings that cannot be reproduced are held back and labelled unconfirmed.
No member yet
One queue for many techniques
Static analysis, fuzzing and dependency checks feed one ranked list instead of separate tool dashboards.
No member yet
Fix pull requests with tests
An agent drafts a patch and a regression test. You read the diff, edit it and merge.
No member yet
Evidence page per finding
Request, payload, code path and the patch in one link you can send to the owning developer.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#10231FDeep Ink · text#F5F3ECPaper · surface#1F6B57Fern · primary#E0A100Signal Amber · accent#B3402FBrick · data: critical#D9E2DCMist · secondary surface
Typography
Aa
Plainproof
PricingAI proposal
Based on the competitor pricing pages in the material: Snyk lists a free plan and one paid plan at $25 a month, SonarQube a free plan and paid plans from $34 a month, Checkmarx prices on request. Team price is a starting point to test.
Free
Free
- 1 repository
- Weekly scans
- Verified findings list
Team
$29 a month
- Per developer
- Unlimited repositories
- Fix pull requests with tests
- Continuous re-checks
- Evidence pages
Organization
Contact us
- Custom rules
- API access
- SSO and audit log
- Priority support
Would you pay Team · $29 a month?
Your answer tells PWAS which prices people accept. It changes no score.
No answers yet.
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- Shared outputs. Each confirmed finding has a shareable evidence page with repro steps and the proposed patch. Engineers send it to the code owner, who sees the product's name on it and can open the pull request.
- Do they become customers?
- Code owners who receive a page are developers, not buyers, though some may use the free tier. Test whether they sign up and whether their security lead then pays for the team.
- First customers
- AppSec leads and DevSecOps engineers at software companies of 50 to 300 people, with a GitHub-based codebase and no dedicated penetration testing team.
- Where to reach them
- Security communities: Share open example evidence pages on forums and Slack groups for AppSec and DevSecOps, and offer free scans of open-source projects.
- GitHub open-source scans: Open pull requests with verified fixes to public projects, noting how they were found, and invite maintainers to try the product.
- Direct outreach: Contact AppSec leads who publicly complain about scanner false positives and offer a two-week pilot on one repository.
- First milestone
- Five teams run a pilot on a real repository and at least two pay after 30 days.
Why people already pay for this
- VerifiedGitHub repository gained 511 stars in 55 days
- Public claimA unified platform that finds, verifies, and fixes vulnerabilities using AI and autonomous agents
- AI inferenceIntegration of multiple vulnerability detection techniques including binary analysis, fuzzing, and SAST
- Public claimOpen-source, self-improving, extensible architecture for security tooling
- AI inference
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Sandboxed executionIsolated container runnersFuzzing and reproduction attempts run untrusted code and must be separated from the main app.
- This app · Analysis enginesOpen-source static analysis and fuzzing toolsReuse proven scanners and add the verification and fix layer on top.
RisksAI inference
- AIAgent-drafted patches may be wrong or introduce new bugs. Reproduction tests and mandatory human review reduce this, but trust will be won or lost on patch quality.
- TechnicalSafely running code and exploit attempts in sandboxes is hard and costly. Reproduction is only reliable for some vulnerability classes at first.
- CommercialEstablished vendors already sell to these buyers, and the material gives no evidence that teams will switch. The 511 GitHub stars show interest, not payment.
- DataCustomers must trust the product with private source code. Sending code to language model providers may be refused by security-conscious buyers.
- RegulatoryActive testing needs clear authorisation. Scans must be limited to targets the customer owns, with logged consent.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.