Code analysis
Static review, dependency and secret scanning, with secure-coding fixes your team can apply.
Velqor Stack / Security testing platform
Verify every layer.
Code analysis, web and server vulnerability testing, evidence-based reports and managed patching, in one platform. Every engagement ends with a retest.
codeweb appsAPIsserverspatchespost-quantum
Services
Seven services, one evidence chain.
Scope, test, report, consult, patch, verify. The same names are used across the platform, proposals and reports, so nothing gets lost between a finding and its fix.
Web & app testing
Vulnerability testing of web pages, web apps and APIs. Automated coverage, manual depth.
Server scans
Infrastructure, configuration and exposure scanning with results ranked by real risk.
Vulnerability & patch management
Tracked remediation, agreed patch windows and retest verification for every open item.
Report generation
Executive and technical reports: severity, evidence, affected scope and the fix.
Results consultation
A walk-through of findings, risk decisions and a remediation plan with owners and dates.
Quantum programming & security
Quantum algorithm development and post-quantum cryptography testing.
Every engagement ends with a retest
Findings are closed when we confirm the fix, not when the ticket is.
How it works
From first scan to verified fix.
Step 1
Scope
Confirm target ownership, boundaries and what is out of scope.
Step 2
Test
Code, application and server testing, automated and manual.
Step 3
Report
Findings with severity, evidence, impact and a specific fix.
Step 4
Consult
Risk decisions and a remediation plan agreed with your team.
Step 5
Patch
Tracked remediation inside agreed patch windows.
Step 6
Verify
Retest and close. A finding is fixed when we can no longer reproduce it.
Pricing
Human-verified testing from $300 per scan.
A manual penetration test typically starts at $5,000. Velqor Stack starts at $300 with human-verified findings and a retest included.
Scans one target, one purchase, retest included
Code
Code analysis
Starting at$350per scan
Static analysis of one repository up to 50,000 lines (larger repositories are quoted). 48 hours from repository access for repositories up to 50,000 lines.
See what is includedWeb apps
Web application testing
Starting at$350per scan
Crawl and vulnerability scan of one web application (one hostname). 3 business days from scope confirmation.
See what is includedAPI
API testing
Starting at$550per scan
Endpoint discovery from the specification you provide (OpenAPI or Postman) or from traffic. 3 business days from specification hand-over.
See what is includedServers
Server scans
Starting at$300per scan
External exposure scan of one host or public IP. 2 business days from ownership confirmation.
See what is includedBundle
Full stack baseline
One server, one web application, one repository and one API
- All four scans in one engagement
- One report, one consultation, one retest covering all four
- Human verification of every Critical and High finding
- Tested-by badge after the retest
Need authenticated testing or ongoing coverage? See Verified engagements from $1,800 and Continuous plans from $249 a month →
Prices in USD, excluding tax. Target ownership is confirmed and the scope agreed before any scan runs.
Platform
One dashboard for scans, findings and retests.
Run scans against targets you own, track every finding from open to verified, and generate the client report from the same data.
- Target ownership is confirmed before any scan runs, with a full audit log.
- Severity follows CVSS bands and is always written out, never shown by colour alone.
- Reports export to PDF with evidence, reproduction steps and fix guidance.
- Scheduled retests reopen anything that regresses.
SCAN / app.exampleRUNNING
Critical
0High
0Medium
0Low
0SQL injection in search parameter/api/search · q
CRITICALOutdated OpenSSL on web-01web-01 · package
HIGHMissing rate limit on login/auth/login
PATCHEDQuantum practice
Forward-secure, not just secure today.
Cryptography that is safe now may not survive a large quantum computer. We develop quantum algorithms and test systems for post-quantum readiness, so the migration is planned rather than forced.
Post-quantum cryptography testing
Inventory of in-use algorithms, exposure to harvest-now-decrypt-later risk, and a migration path to NIST-standardised schemes.
Quantum programming
Algorithm design and prototyping for research and industry pilots, with results stated honestly: what was demonstrated and what was not.
Trust
What you can hold us to.
Nothing published without consent
Client names, hosts, screenshots and findings stay confidential unless you put it in writing.
Evidence for every claim
Each finding carries reproduction steps and scope. Reports state what was not tested as clearly as what was.
No fear-selling
We rate risk precisely and recommend fixes in order. We do not promise total security, and we do not use scare tactics to sell.
Request an assessment
Tell us what you need tested.
We reply within one business day with a scoped proposal. No scan runs until ownership of the target is confirmed.
- Web, app and API testing
- Code analysis and server scans
- Ongoing patch management
- Post-quantum readiness review