Choose how deep the audit goes
Every audit runs the same 45 deterministic scanners. The tier you pick chooses the AI engines that reason on top — and we show our workings: real plugins, real findings, published evaluation reports.
Standard
Fast and thorough on classic vulnerability classes — nonce checks, escaping, SQLi patterns. The engine that has powered every audit since launch.
Advanced
A reasoning engine that traces flaws across files — authorization-logic bugs, trust-boundary violations, and injection paths that pattern matching misses.
Premium
Two top models audit independently. Findings both models catch are promoted to HIGH confidence; single-model claims are marked for review. The fewest false positives money can buy.
The evaluation, in numbers
From our 2026-07 evaluation runs on two production plugins (~30 auditable files each) plus a seeded-vulnerability fixture corpus.
| Metric | Standard | Advanced | Premium |
|---|---|---|---|
| Security findings (plugin A) | 4 | 7 — incl. an authorization-logic flaw no other model caught | 7+7 cross-validated |
| Security findings (plugin B) | — | 4 — incl. an attribute-breakout XSS | 4+7 cross-validated |
| Engines completing without parse errors | 2/3 (a11y parse fail, now fixed via structured outputs) | 3/3 | 3/3 |
| Seeded-vulnerability recall (fixture corpus) | 5/5 | 5/5 | 5/5 |
| False positives on known-clean fixture | 0 | 0 | 0 |
| Typical cost per audit | ~£0.03 | ~£0.40 | ~£0.80 |
Methodology: identical plugin inputs per model, raw engine output (before production false-positive filters), costs at provider list prices. Sample size is two plugins — directionally useful, not statistically definitive. Full evaluation reports are linked from our changelog; the harness (scripts/eval-models.ts) is public in our repo and re-runnable by anyone.
Try all three on your own plugin
Free accounts get unlimited Standard scans plus one full AI audit every month.