The branded PDF your stakeholders read — cover, verdict, and the fix in plain English, generated from this same verified data.
Your store is up and taking payments, but a stranger with no login can reach a takeover-level flaw and download a backup file with your live payment and database passwords.
Two of these let anyone run code on your server with no login: WP File Manager and the Bricks theme. A third leaves a backup file public that holds your live payment keys. A stranger could hit all three today.
Posture ring
The 2-second answer. One grade and the severity mix, before anyone reads a word.
Findings
Every finding ships with its proof exhibit — the exact request and response that triggered it.
Manifest
The reproducibility pin. Model settings, tools, and prompt hashes frozen before any model call.
Trace
The agent's full reasoning, step by step — every verdict traces back to the probe that earned it.
Want the play-by-play? Read how Notra thinks, or watch a run happen live on /watch.
harborlanterngoods.com isn’t a real site. The findings map to real, patched CVEs, and every proof here is a harmless check, not an exploit.
Want this for your own site? Start with the free scorecard, then keep it current with monitoring — plans and per-site pricing live on pricing.
See what’s actually exploitable on your site.
Run the free scorecard first, or read the full sample above to see exactly what a verified audit delivers.