Check any app's code. Every finding cites its file and line.
Pay as you go
no monthly fee
565 rules in 32 families, matched against:
- Android: the decompiled code
- iOS: the decrypted build
- the store listing
Each finding is a rule match. The same build and rule pack give the same findings every time.
510 rules name a law or platform policy.
In a project, each app gets a status for each of the 31 rule sets.
iOS rule scans need Researcher.
- 30 Android rule scans a month
- No credit card to sign up
A model answers from one app's decompiled code.
- Cited files and quoted lines are checked against the build
- The reasoning is AI output
$25 a message, paid from the account balance. One message can ask several things.
Researcher adds follow-ups and questions across a project.
A 7-stage AI pipeline:
- decompiles the build and maps the calls from app startup
- traces the code behind network requests, ads and links
- checks for false positives before the report
Usually up to 30 findings. Each one is AI output.
An 8-stage AI pipeline:
- lists every file of the app
- checks that the app's entry points reach the code behind each finding
- sends every finding to a separate red-team review
Findings are AI output. A result can be marked NOT RATED.
A model taps through the app's first screens on a test device. The network traffic is recorded.
Requests before and after the consent prompt are listed separately.
A capture shows the requests the app makes. A scan shows what the build contains.
- Each rule scan past 3 a day or 30 a month costs $0.50 from the account balance.
Researcher
a month
On Pay as you go, a month of these costs:
- 25 questions × $25 = $625
- 5 Deep scans × $100 = $500
- 3 captures × $20 = $60
- 470 extra rule scans × $0.50 = $235
Total $1,420. Researcher is $800.
This total leaves out uploads, iOS rule scans, the plugin, exports and private results.
a year
On Pay as you go, a month of these costs:
- 25 questions × $25 = $625
- 5 Deep scans × $100 = $500
- 3 captures × $20 = $60
- 470 extra rule scans × $0.50 = $235
Total $1,420 a month, $17,040 a year. Researcher is $8,000 a year.
This total leaves out uploads, iOS rule scans, the plugin, exports and private results.
565 rules in 32 families, matched against:
- Android: the decompiled code
- iOS: the decrypted build
- the store listing
Each finding is a rule match. The same build and rule pack give the same findings every time.
510 rules name a law or platform policy.
In a project, each app gets a status for each of the 31 rule sets.
- 500 Android rule scans a month
Each iOS app is downloaded and decrypted on a test device first, about 1 to 4 minutes per app.
Only versions that need decrypting count toward the iOS limits.
- 100 iOS rule scans a month
A model answers from the app's decompiled code. A rule scan of the same build is included.
- Cited files and quoted lines are checked against the build
- The reasoning is AI output
One question per app answered: 1 for one app, 40 for a project of 40.
Several questions in one message count as one.
A 7-stage AI pipeline:
- decompiles the build and maps the calls from app startup
- traces the code behind network requests, ads and links
- checks for false positives before the report
Usually up to 30 findings. Each one is AI output.
A model taps through the app's first screens on a test device. The network traffic is recorded.
Requests before and after the consent prompt are listed separately.
A capture shows the requests the app makes. A scan shows what the build contains.
- Questions work on an uploaded build. Deep scans need a Google Play or App Store link.
- Markdown, JSON, CSV exports
The citt command in Claude Code or Codex:
- starts scans
- lists findings
- asks questions
- downloads exports
- Private scan results
Deep Researcher
a month
On Pay as you go, a month of these costs:
- 50 questions × $25 = $1,250
- 10 Deep scans × $100 = $1,000
- 3 Ultra-deep scans × $500 = $1,500
- 10 captures × $20 = $200
- 970 extra rule scans × $0.50 = $485
Total $4,435. Deep Researcher is $1,500.
This total leaves out uploads, iOS rule scans, the plugin, exports and private results.
a year
On Pay as you go, a month of these costs:
- 50 questions × $25 = $1,250
- 10 Deep scans × $100 = $1,000
- 3 Ultra-deep scans × $500 = $1,500
- 10 captures × $20 = $200
- 970 extra rule scans × $0.50 = $485
Total $4,435 a month, $53,220 a year. Deep Researcher is $15,000 a year.
This total leaves out uploads, iOS rule scans, the plugin, exports and private results.
- Everything in Researcher
565 rules in 32 families, matched against:
- Android: the decompiled code
- iOS: the decrypted build
- the store listing
Each finding is a rule match. The same build and rule pack give the same findings every time.
510 rules name a law or platform policy.
In a project, each app gets a status for each of the 31 rule sets.
- 1,000 Android rule scans a month
Each iOS app is downloaded and decrypted on a test device first, about 1 to 4 minutes per app.
Only versions that need decrypting count toward the iOS limits.
- 200 iOS rule scans a month
A model answers from the app's decompiled code. A rule scan of the same build is included.
- Cited files and quoted lines are checked against the build
- The reasoning is AI output
One question per app answered: 1 for one app, 40 for a project of 40.
Several questions in one message count as one.
A 7-stage AI pipeline:
- decompiles the build and maps the calls from app startup
- traces the code behind network requests, ads and links
- checks for false positives before the report
Usually up to 30 findings. Each one is AI output.
An 8-stage AI pipeline:
- lists every file of the app
- checks that the app's entry points reach the code behind each finding
- sends every finding to a separate red-team review
Findings are AI output. A result can be marked NOT RATED.
A model taps through the app's first screens on a test device. The network traffic is recorded.
Requests before and after the consent prompt are listed separately.
A capture shows the requests the app makes. A scan shows what the build contains.
Custom
- Everything in Deep Researcher
- Monthly limits by agreement
- Team members share the plan
Investigation
One app's requests, and the hosts that receive them
- Deliverable
- A written report
- Evidence
- Every finding cites a captured request, or the file and line of the code that builds it. The capture shows what is sent. What a recipient does with it needs other evidence.
- Price
- Starting $12,000
A person uses the app by hand on rooted Android and jailbroken iOS test devices.
The network traffic is captured and decrypted. It shows each host the app contacts and the identifiers in each request.
A reviewer searches the decompiled code for the code that builds each request.
Plan captures are automated. Here a person tests the screens the question is about.
Published teardowns
Questions about plans
What happens when I reach a limit?
Past a limit, each request is charged to the account balance:
- Pay as you go: $0.50 a rule scan past 3 a day or 30 a month, $25 a question
- Researcher and Deep Researcher: the same prices once a monthly count is used up
Limits and balance are checked before a request starts. If the balance is short, the request stops and nothing is charged.
What runs on Pay as you go?
Rule scans of Android apps. Each finding cites its file and line. Most rules also name a law or platform policy.
Questions, Deep scans, Ultra-deep scans and network captures use a model. Pay for each one, or get them in a plan.
What if a scan or question fails?
A scan or question that fails before analysis starts is refunded to the balance.
The history lists the refund under the charge.
Who can see my results?
- Pay as you go: rule scan results are visible in the account that started the scan
- Researcher and above: scan results are private until published
- Every plan: questions, answers and uploaded builds are private
Public app pages are built from Deep scans.
Are iOS and Android both covered?
Yes. A scan starts from a Google Play or App Store link, or a package id.
- Android rule scans: every plan
- iOS rule scans: Researcher and Deep Researcher, with separate daily and monthly counts
- Questions and Deep scans: both platforms
iOS apps are decrypted on a jailbroken device first. Scans cover apps that are free to download.
What is in an export?
Per scan:
- JSON: every finding and its evidence
- CSV: one row per finding (rule, family, severity, title, file paths)
- Markdown: findings grouped by severity
Per project: a zip with one JSON file per app, a manifest and SHA-256 checksums.
Exports are unlimited and outside the monthly counts.
How do I cancel?
Cancel on the billing page: Manage subscription opens Stripe's billing portal.
The plan stays active to the end of the paid month. The billing page shows the end date.
After that date, projects lock until a plan is active again.
How does annual billing work?
Pay 10 months, get 12:
- Researcher: $8,000
- Deep Researcher: $15,000
Counts reset every month of the year.
Pay by card at checkout. For an invoice, choose Something else in the brief form on Work with us.
Can an app pay to change its score?
No. The score is computed from the findings in the app's build. Payments change no score, band or public page.
Rated apps pay nothing. Plan buyers, investigation clients and donations fund the site.