Target scope
One explicitly agreed website or public API target. Subdomains, related applications and other assets are not automatically included.
ProcessInternet security testing for small businesses
It works.
But is it secure?
Before launch or after a redesign, check your public security exposure. For software teams and small businesses without dedicated security staff.
An engineer-reviewed report is delivered within two business days after ownership verification, authorization, scope, necessary materials and payment are confirmed.
Standard public security check · US$120Engineer reviewDeliverable
SERVICE SCOPE
For public-facing, non-sensitive businesses
One explicitly agreed website or public API target. Subdomains, related applications and other assets are not automatically included.
Who we serve
- SaaS and software services
- E-commerce and retail
- Logistics, manufacturing and B2B services
- Media and other non-sensitive industries
Not currently covered
- Government, banking, finance, securities and payment cores
- Healthcare and critical infrastructure
- Internal systems accessible only through LAN, VPN or private links
- Unauthorized, destructive or load testing
- No testing of logged-in features, multiple account roles, business workflows or complex business logic.
SERVICES
Included checks
Unauthenticated public exposure, basic security configuration and verifiable common security risks. The specific checks are confirmed before ordering.
Included checks
Unauthenticated public exposure, basic security configuration and verifiable common security risks. The specific checks are confirmed before ordering.
ProcessDeliverable
A PDF in an agreed language, covering scope, summary, evidence, impact, remediation and exclusions, delivered to your designated email.
ProcessSIMPLE PRICING
Standard public security check · US$120
An engineer-reviewed report is delivered within two business days after ownership verification, authorization, scope, necessary materials and payment are confirmed.
Standard public security check · US$120US$120An engineer-reviewed report is delivered within two business days after ownership verification, authorization, scope, necessary materials and payment are confirmed.
- Unauthenticated public exposure, basic security configuration and verifiable common security risks. The specific checks are confirmed before ordering.
- A PDF in an agreed language, covering scope, summary, evidence, impact, remediation and exclusions, delivered to your designated email.
- Target scope
- One explicitly agreed website or public API target. Subdomains, related applications and other assets are not automatically included.
- Not included
- No testing of logged-in features, multiple account roles, business workflows or complex business logic.
- What to prepare
- For an inquiry, provide your company, work email, target and requirements. Ownership proof may follow; authorization must be verified before testing.
- Retesting
- Remediation retesting is not included in the base price. Scope, timing, number of rounds and fees are agreed separately.
- Additional fees
- Multiple targets, additional assets or retesting require separate scope and fee confirmation before work begins.
View a sample report
Report structure example: fictional target and finding, illustrating format only. Not a client result or a promise to find vulnerabilities.
Scope
Example target: https://example.com; public, unauthenticated pages only. Actual reports specify dates, paths and methods.
Summary
Example: one configuration issue requiring attention. Verified findings are distinguished from limitations and exclusions.
Evidence
Example: a public page response has no Content-Security-Policy header. Record the path, time and redacted response headers. This alone does not prove exploitable XSS.
Business impact
A browser-side defense layer may be missing. Actual impact depends on page behavior and other controls.
Remediation
Define a policy matching required scripts and resources. Assess effects in report-only mode before enforcing and validating it.
Not covered
Logged-in features, account roles, business logic, subdomains and unagreed assets. This example contains no remediation or retest outcome.
HOW IT WORKS
Five steps to your security report
An engineer-reviewed report is delivered within two business days after ownership verification, authorization, scope, necessary materials and payment are confirmed.
01→
Submit inquiryFor an inquiry, provide your company, work email, target and requirements. Ownership proof may follow; authorization must be verified before testing.
02→
ConnectSubmit project details. Our team will contact you to confirm package fit, authorization materials and scheduling. An inquiry does not start testing.
03→
Confirm paymentCancellation, postponement and refund conditions are explained before order confirmation and payment, and recorded in the mutually agreed order terms.
04→
Begin checksUnauthenticated public exposure, basic security configuration and verifiable common security risks. The specific checks are confirmed before ordering.
05✓
Receive reportAn engineer-reviewed report is delivered within two business days after ownership verification, authorization, scope, necessary materials and payment are confirmed.
ANONYMIZED ASSESSMENT
Years of uptime are not proof of security.
The platform supported employee access and business-document workflows. The project owner described years of operation without obvious day-to-day anomalies. That is not evidence of security validation. The report recorded 12 findings: 3 Critical, 3 High and 6 Medium. Below are findings and remediation recommendations from that case.
Real anonymized case: the historical assessment scope does not represent the US$120 package. Findings do not establish a breach; remediation is not claimed without retest evidence.
1. Login boundary
A valid session without normal login credentials.
The report records a server-issued session permitting access to employee-directory and permission information.
- A login page is not proof of effective authentication.
2. Backend access
Some backends did not reliably verify the caller.
The report records responses containing employee information, partner data and business records.
- Frontend restrictions do not establish backend access control.
3. Production storage
Production storage credentials appeared in frontend resources.
The report records business-document reads and write/delete verification using self-created test objects.
- Confidentiality and integrity were at risk. Test-object operations do not establish damage to customer files.
4. Content handling
Unvalidated content could affect administrator sessions.
The report describes insufficient checks at some content submission points; submitted content could execute script when an administrator viewed it.
- Business content can become an entry point into administration.
5. Remediation sequence
Close entry points. Rotate secrets. Retest.
These are report recommendations, not a claim that remediation is complete.
- Fix login and backend identity checks; restrict sensitive endpoints.
- Rotate production secrets and restrict storage access. Removing a key from frontend code alone is insufficient.
- Handle input safely; retest denied access, invalidated old credentials and safe handling of malicious content.
An anonymized summary of a supplied assessment report. Customer identity, addresses, technical paths and exploit details are withheld. Operating history is project background; counts and ratings are report-derived, not independently revalidated here. This does not establish a real intrusion or completed remediation. Scope is agreed separately; this case does not represent coverage of the US$120 package.
MINGXIEngineer review
PROFESSIONAL, PRACTICAL
Engineer review
Engineers review evidence validity, severity and remediation guidance. Testing is scoped and point-in-time, not a guarantee of finding every vulnerability.
- Mingxi Security Check is a security service product from the Mingxi team.
- hello@mingxi.io
- We process company name, contact person, phone, email, contact preference, WeChat or WhatsApp, request details and ownership proof to respond, verify authorization, perform the service and deliver reports. Inquiry records are kept for up to 12 months; orders and reports follow the final service agreement. You may request access, correction or deletion at hello@mingxi.io. Necessary providers such as email delivery and site analytics may receive relevant data; cross-border processing will be disclosed as required by applicable law.
About us
Technical depth. Practical delivery.
Mingxi Security Check is a security service product from the Mingxi team.
Meet MingxiMingxi is a team of AI technologists and enthusiastic builders with extensive industry experience. We care about what technology can do—and how it fits real operations, team capabilities and delivery schedules.
We understand both the importance of security and the constraints of putting it into practice. With Mingxi Security Check, we aim to turn security assessments into clear risk decisions, actionable remediation guidance and prioritized next steps.
FAQ
Frequently asked questions
What does US$120 include?
Unauthenticated public exposure, basic security configuration and verifiable common security risks. The specific checks are confirmed before ordering. One explicitly agreed website or public API target. Subdomains, related applications and other assets are not automatically included.
What requires a separate quote?
Multiple targets, additional assets or retesting require separate scope and fee confirmation before work begins.
Are accounts needed? Are logged-in features tested?
No testing of logged-in features, multiple account roles, business workflows or complex business logic.
When do the two business days start?
An engineer-reviewed report is delivered within two business days after ownership verification, authorization, scope, necessary materials and payment are confirmed.
What is in the report? Can I see a sample?
A PDF in an agreed language, covering scope, summary, evidence, impact, remediation and exclusions, delivered to your designated email.
Does retesting cost extra?
Remediation retesting is not included in the base price. Scope, timing, number of rounds and fees are agreed separately.
What if no vulnerabilities are found?
We deliver the agreed checks and their limitations even when no vulnerabilities are found. No findings does not mean the system has no other security risks.
How do cancellation, delays and refunds work?
Cancellation, postponement and refund conditions are explained before order confirmation and payment, and recorded in the mutually agreed order terms.
Confirm scope and delivery timing
Submit project details. Our team will contact you to confirm package fit, authorization materials and scheduling. An inquiry does not start testing.
An early assessment can prevent a high-risk entry from reaching production
A public business checked its external surface before release, prioritized the fixes and reduced emergency response cost.
FAQA larger attack surface does not always require more complex tooling
Start with the public assets and key flows, then use one expert assessment to find what deserves attention first.
FAQReport language tailored to each customer
The website is available in Simplified Chinese, Traditional Chinese, English, Japanese, French, German, Portuguese and Spanish. Report language is agreed with each customer.
FAQ