About NovaPentest

NovaPentest exists because most web applications are tested for security far less often than they change. A manual penetration test is valuable, but it is a snapshot: expensive, scheduled months ahead, and out of date as soon as the next release ships. In the weeks in between, new endpoints, configuration changes and updated dependencies go live without anyone attacking them.

We build software that fills that gap. NovaPentest attacks your web applications and APIs the way an adversary would, on demand, on a schedule or from your deployment pipeline, so that real, exploitable problems surface before someone else finds them. It is designed for small and mid-sized teams that need serious testing without a dedicated security department, and it has been developed since 2024.

The platform runs around sixty checks against each target. Some are configuration checks: TLS, security headers, cookies, CORS, DNS and email authentication. Others are active probes that send real payloads for SQL, NoSQL, command, LDAP and template injection, cross-site scripting, SSRF, XXE, path traversal and other classes, and confirm what comes back. On paid plans, an LLM-driven agent then explores the application like an attacker, following leads the fixed checks cannot anticipate, within a strict request budget.

Every finding comes with evidence, a severity score, an OWASP Top 10 and CWE mapping, and concrete remediation steps. Around that sit the things a team needs to act on results: PDF reports, scan history that shows what changed between runs, an OWASP Top 10 compliance view, integrations with webhooks, Slack and Jira, and an API for CI/CD. Anyone can also run a free, passive scan at /scan, without an account, and get an A to F grade.

We hold ourselves to a few rules. First, we only test what we should. Targets are validated before every scan, and the scanner refuses to connect to private, internal or cloud-metadata addresses, even when a redirect points there. The public scanner is passive by construction: it runs an explicit allowlist of observation-only checks and never sends attack payloads.

Second, we are specific. A finding without evidence is noise, so each one shows the evidence we observed and how to fix it. Our security guides name the module that performs each check, so you can see exactly what we test.

Third, we are honest about limits. Automated testing does not replace a skilled human pentester for business logic, chained attacks or formal attestation, and we say so, including on our own comparison pages. We would rather you trust what we do claim.

NovaPentest serves Brazilian and Portuguese-speaking teams natively, not as an afterthought. The entire interface is available in Brazilian Portuguese, the public site has its own Portuguese addresses under /pt, and our security guides are written in Portuguese rather than machine-translated, because a mistranslated remediation step is bad advice, not just bad copy.

Pricing works the same way. The Pro plan is offered in Brazilian reais at R$125 per month, charged in reais through Stripe, alongside the US dollar price of $24.90 per month for everyone else. Brazilian teams can adopt continuous security testing without converting currencies or working through an English-only product.