DenyFirst
// Pricing
Priced like an audit.
Not a toy.
Every scan is a real probe in an isolated box, ownership-proven, read-only by default. Your first scan is free, no noise after that: just the access-control issues that matter, with the exact fix.
Plans
Pro
$2,388/yr billed annually · or $299/mo month-to-month
- 3 apps
- Unlimited on-demand scans (fair-use rate limits apply)
- Full six-vector probe suite: broken reads, missing RLS & Firestore rules, exposed storage, leaked keys, auth misconfig
- Exact one-line fixes + reproduction
- Re-scan to verify the fix
- Email support
Agency
$5,988/yr billed annually · or $649/mo month-to-month
- 20 client apps
- Unlimited on-demand scans (fair-use rate limits apply)
- Everything in Pro
Enterprise
For platforms & portfolios
- Unlimited apps
- Everything in Agency
- SSO, audit logs, SLA
- CI/CD & API access
- Dedicated support
// annual billing is the best rate · month-to-month has no lock-in · cancel anytime
Your first scan is free, and every paid month is guaranteed. Run a real scan on your own backend before you pay a cent. If a paid month isn't worth it, ask within 30 days and we return it in full, no questions asked.
// Compare
Every plan, side by side.
| Feature | Pro | Agency | Enterprise |
|---|---|---|---|
| Apps | 3 | 20 | Unlimited |
| Continuous scanning | Included | Included | Included |
| Probe vectors | All six | All six | All six |
| Exact fixes + reproduction | Included | Included | Included |
| Re-scan to verify | Included | Included | Included |
| SSO · audit logs · SLA | Not included | Not included | Included |
| CI/CD & API access | Not included | Not included | Included |
| Support | Priority | Dedicated |
// FAQ
Straight answers.
Do you need access to my backend?
You connect via OAuth so we can confirm you own the Firebase or Supabase project. Scans are read-only by default and only ever run against apps you own.
What counts as one app?
One backend project: one Firebase project or one Supabase project.
Is there a free trial?
Your first scan is free. It runs the same real probe in an isolated box as a paid one, on a backend you've verified you own, so you see an actual report on your own app before you decide. After that, scanning is a paid plan. Annual billing gets the best rate; month-to-month is there if you'd rather not commit.
What if you don't find anything?
Your free first scan means you see that result before paying anything. If you've already subscribed and a paid month isn't worth it, ask within 30 days and we refund it in full, whatever the scan did or didn't find. We don't adjudicate whether a finding "counts": the guarantee is unconditional inside the window.
Can I cancel?
Yes. Month-to-month has no lock-in, so you can cancel anytime. Annual plans run for the year and renew yearly.
How is this different from a scanner?
Scanners guess from static rules and flood you with false positives. DenyFirst proves the issue by actually reaching the data as an anonymous or signed-in user, then hands you the exact rule to change.
Ship it locked.
Scan my app// read-only by default · proof before packets · your data never leaves the box