Closeout
For boutique pentest firms & independent testers

The report isn't the finish line. Closeout is.

Turn every pentest report into a live remediation portal, with automated, scope-enforced retests that take minutes instead of billable days.

No card required · unlimited client users

closeout.app/portal/acme-web-q4
Acme web app, Q4
Redline Security · 3 findings
0%
  • F-001IDOR on /api/invoices/:idOpen
  • F-002Reflected XSS in /searchOpen
  • F-003Missing rate limit on loginOpen
GET https://app.acme.test/api/invoices/1002
· waiting for client to ship a fix

Works with the tools you already use

Burp Suite XML
Nuclei
CSV & spreadsheets
JSON
SysReptor (soon)
Ghostwriter (soon)
Jira
Linear
GitHub Issues

How it works

From PDF to verified fix in four steps

The weeks after delivery are where findings stall and retests eat your margin. Closeout owns that stretch.

01

Import the report you already wrote

Drop in a Burp Suite XML, Nuclei, JSON or CSV export. Burp issues and Nuclei HTTP results keep their original request, so they're ready to replay.

burp-acme-q4.xml✓ 14 findings
findings.csvready
export.jsonready
02

Your client signs off on scope

The client acknowledges the exact hosts and testing window inside the portal. No acknowledgement, no retests. It's enforced in code, not policy.

app.acme.com*.api.acme.com
Acknowledged by Ada (Acme) · Oct 14
03

They ship a fix and click one button

Engineers hit “We've deployed a fix”. Closeout replays the proof from fixed IPs, rate-limited, and judges the response against your signature.

We've deployed a fix
→ retest queued · 1 req/s per host
04

You confirm. They get an attestation.

The engine never closes findings on its own. You review the evidence, confirm, and the client downloads a dated letter for their auditor.

Remediation attestation
F-001 CriticalVerified fixed
F-002 HighVerified fixed
F-003 MediumVerified fixed
Minutes

to retest a finding, instead of rebuilding context weeks later

0

findings closed without a human signing off

$0

per client seat, on every plan

Security

Built by people who'd try to break it

A service that replays attack traffic has to be paranoid. Here's what keeps it on a leash.

Scope is a hard wall

Every retest is checked against the client-acknowledged host list and testing window before a single packet leaves.

DNS-rebinding proof

Targets are resolved once, every address is validated, and the connection is pinned. Private ranges and cloud metadata are unreachable.

Credentials stay sealed

Session tokens in proof requests are encrypted with a per-engagement key (AES-256-GCM, row-bound). The API never returns them.

No false 'fixed'

Expired sessions, WAF blocks and 5xx responses come back inconclusive, never fixed. A human confirms every closure.

Tenant isolation in the database

Postgres Row-Level Security confines every query to one firm. A missing WHERE clause returns nothing, not someone else's findings.

Append-only audit trail

Every retest records who asked, what was sent, and which IP it resolved to. The application role can't edit history.

Pricing

Pays for itself with two saved retest hours

Billed monthly in EUR or USD · plus VAT where applicable · cancel anytime

Solo

$49/mo

  • 1 tester
  • 5 active engagements
  • 100 retests / month
  • Branded client portal
  • Burp / Nuclei / CSV / JSON import
  • Scheduled regression checks
  • Attestation letters
Start free trial
Most popular

Firm

$199/mo

  • 5 testers
  • Unlimited engagements
  • 1,000 retests / month
  • Everything in Solo
  • Jira, Linear & GitHub ticket sync
  • Remediation SLA dashboard
Start free trial

Agency

$449/mo

  • 15 testers
  • Unlimited engagements
  • 5,000 retests / month
  • Everything in Firm
  • API access for scripts and CI
Start free trial

Questions

Does Closeout replace my reporting tool?+

No. Keep writing reports in Burp, SysReptor, Ghostwriter or Word. Closeout picks up after delivery: the remediation portal, retests and attestation.

Is it safe to let a SaaS replay exploit requests?+

Retests only reach hosts the client acknowledged, inside the testing window, from published static IPs, one request per second per host. Redirects are never followed, private and metadata addresses are blocked, and a human confirms every fix.

What happens to session tokens in stored requests?+

Headers and bodies are encrypted with a per-engagement data key and only decrypted inside the isolated retest worker. The API shows header names only, and evidence is redacted before anyone sees it.

Do my clients pay for seats?+

Never. Client users are unlimited on every plan, so the portal spreads the word for you.

Close your next engagement properly

Import a report, invite your client, and run your first automated retest in under ten minutes.

Start free trial