# Tenty

> Agentic security testing and uptime monitoring. Built for apps shipped with AI. Scheduled and deploy-triggered runs. Ready-to-use fixes for every finding. Tenty tries your live app as a stranger and as other users, starting with your Stripe payments and webhooks, then shows the proof and the seal for each finding.

Tenty is built for people who shipped payments with a coding assistant and want to know the money flow holds. It reads the running app from outside, the way a visitor would, and returns after every deploy.

## What Tenty does

- Follow the money: Tenty sends your webhook an event nobody signed, changes the amount in a checkout request and reads your Stripe events hourly. Failed deliveries, refunds and disputes land in your inbox with a plain explanation
- Every endpoint gets tried: Tenty reads your page and scripts, then calls your endpoints as a stranger, as user A and as user B. Exposed keys, open tables and data that crosses over show up here
- Back after every deploy: Tenty spots a new deploy by its changed scripts and rescans. A GitHub Action or one curl starts a scan from your pipeline and fails it on critical findings. New scripts, routes and source maps are listed, and your app is checked every minute
- See it, then seal it: Each finding shows the raw request, a curl that reproduces it, a severity from critical to low and what it means for your money. A fix prompt and a snippet are ready for your editor, Lovable and Cursor included

## Examples of findings

- Critical: Your webhook accepts events nobody signed. A stranger can unlock paid plans for free. Fix: Verify the Stripe signature before you trust the event
- Critical: Checkout trusts the price from the browser. Anyone can pay a fraction of your price. Fix: Read the price from your product on the server
- High: Access is granted before Stripe confirms. A user can reach the success page without paying. Fix: Unlock the plan from the confirmed webhook event
- High: One event unlocked the plan twice. Retries double your credits and your emails. Fix: Store event ids and skip the ones you handled
- High: Your Stripe webhook is failing. Customers pay and your app never hears about it. Fix: Check the signing secret in your environment
- Medium: Two disputes are waiting for a reply. Disputes have deadlines and the first is due Friday. Fix: Reply with your evidence before the due date
- Critical: A test key runs in production. Customers check out and nobody gets charged. Fix: Switch to live keys in your production environment
- Critical: Anyone can read your profiles table. Emails and billing details are one request away. Fix: Turn on row level security and add a policy
- Critical: A secret key sits in your browser bundle. Whoever opens the page can use your Stripe account. Fix: Rotate the key and move the call to your server
- High: A new script arrived with your last deploy. A script on your checkout page can read card forms. Fix: Review the script or drop it from the build
- Medium: Two headers are missing. Browsers get fewer instructions on how to protect your pages. Fix: Copy the header block into your host config
- Medium: Checkout answers slowly. Slow checkouts lose sales before anything breaks. Fix: Add an index or cache the query behind this route

## Plans

- Free: $0, A weekly light check and a monthly full scan
- Solo: $19 a month, First 50 members pay $12 a month for as long as they stay
- Team: $49 a month, For agencies and small teams, with 10 apps and 5 seats
- Paid plans start with a 14-day trial

## Questions

### What does Tenty test?
Tenty tests your live app from outside, after every deploy. It tries your payments, your sign-ins and your users' data as a stranger and as other users, then shows the proof and the fix for each finding

### How does Tenty test Stripe payments?
On an app you own, Tenty sends your webhook an event nobody signed and changes the amount in a checkout request. With an optional read-only Stripe key it also reads your events hourly and flags failed webhooks, refunds and disputes

### Does Tenty need my code?
Tenty reads the running app from outside, the way a visitor would. The address of your live app is enough to start

### Which editors and builders does it fit?
Any app on a public address. Fix prompts are written for Lovable, Cursor and other editors

### How is Tenty different from a one-time scan?
A scan shows today. Tenty returns after every deploy and every night, and tests as a stranger, as user A and as user B

### When does Tenty open?
Tenty is opening soon. Write to public@tenty.dev for early access

## Contact

Early access: public@tenty.dev
Site: https://tenty.dev/