Website record
A domain enters the system from outreach, an account request, or a support conversation. It becomes the anchor for reports, files, authorization, and service history.
Pick your starting point
Different visitors arrive for different reasons. Use the route that matches what you need to do next.
I need my documentsLogin or create an account to keep reports, downloads, service requests, and support history tied to the right website.I want to submit a siteCreate an account and connect a website to request a free first look or a quoted review.I need help fixing somethingCompare fix packs, authorized reviews, retests, monitoring, and redesign help.
Safe context
Public pages and secure report links explain the risk without turning the page into an exploit guide. Full detail stays tied to verified access.
Clear permission
Deeper testing needs explicit scope, contact rules, and limits around accounts, payment flows, uploads, email, AI usage, and customer impact.
Documents and services
Reports, fix packs, retests, and delivered files live with the account so the owner can track what changed and what still needs attention.
What Flagpole looks for
Credits, paid access, provider costs, quota bypass, invite abuse, AI usage, and workflows that become expensive at scale.
Private objects, tenant boundaries, account state, secrets, internal metadata, downloads, and data that should not reach a normal user.
Rate limits, expensive endpoints, resource exhaustion, email/send abuse, upload pressure, and fragile flows attackers can automate.