deskkit Audit checks a website the way somebody probing it would: what the server admits about itself, which protections are missing, and which files and paths are reachable that were never meant to be. The requests come from your computer — we never see the site you scanned or what was found.
Every finding says what was observed, where, and what to change. There is no grade, no gauge and no “contact us to unlock the details” — the detail is the product. A scan of a small public site typically produces a handful of significant findings and a longer list of hygiene items.
On a paid plan you can export the whole thing to PDF, which is usually what a client or an auditor actually asks for.
The free tier is not a teaser. It returns a real, complete report for an external scan. The paid tiers widen what can be reached — deeper discovery, then your own network — and add the PDF export.
Ending a plan does not lock the program. When a subscription stops the tier drops back to Free and the app keeps working — you keep the reports you have made and you can still run external scans. Nothing you paid for is taken hostage.
Signing in runs 600,000 rounds of PBKDF2 locally and sends only the derived verifier. The password itself never leaves the app, so there is no copy of it here for anyone to lose.
Your plan arrives as a signed token that the app verifies on your own machine with an Ed25519 public key. Scanning does not phone home, and it keeps working while you are offline.
You sign in here with Google and choose the password the app will use. There is no confirmation email to wait for and no reset link to lose.
The account side is live already — you can sign in and set your password today. The installer is not out yet. Leave an address and you will get one message when it is, and nothing else.