Question 1

How are credits consumed?

Accepted Answer

Monthly subscription credits are used first. Purchased credits are used afterward and never expire.

Question 2

Do purchased credits increase my concurrency?

Accepted Answer

No. Concurrency is determined by your active subscription plan.

Question 3

Do credit packs unlock Pro or Max features?

Accepted Answer

No. Credit packs only add additional scan credits. Features remain based on your active subscription tier.

Question 4

How do wildcard scans consume credits?

Accepted Answer

Wildcard scans use 1 credit for the parent target plus 1 credit for each discovered live subdomain that is scanned.

Question 5

What's the concurrent scan limit?

Accepted Answer

Hacker runs 2 scans at a time, Pro runs 4, and Max runs 6. New scans queue automatically once you hit your plan's ceiling and start as soon as a slot frees up. Upgrades raise the limit immediately.

Question 6

What happens if I run out of credits?

Accepted Answer

New scans are blocked until you top up. You can buy a one-time credit pack from the Billing page (delivered instantly) or upgrade your plan for a larger monthly allowance plus higher concurrency.

Question 7

How does billing work?

Accepted Answer

Choose monthly billing or save 20% with an annual commitment via Dodo Payments. Annual plans charge the full year upfront; the monthly equivalent is shown for comparison. Credits follow your allowance and billing schedule.

Question 8

What happens when I upgrade mid-cycle?

Accepted Answer

Upgrades take effect immediately. You're charged a prorated amount for the days remaining in your current period, and the higher credit allowance and concurrency limit are unlocked instantly. The next renewal is charged at the new plan's full price.

Question 9

What happens when I downgrade?

Accepted Answer

Downgrades are scheduled for the end of your current paid period — you keep the higher plan's credits and concurrency until then. On the renewal date, the cheaper plan and its limits take effect. You can cancel a scheduled downgrade any time before it lands.

Question 10

Can I cancel anytime?

Accepted Answer

Yes. Cancel from the Billing page; you keep full plan access through the end of the current billing period, and any one-time credit-pack balance stays available indefinitely. There are no cancellation fees.

Question 11

Will I get a refund if I cancel?

Accepted Answer

Subscriptions are non-refundable for the current period, but you keep access until it ends. One-time credit packs are non-refundable once delivered. For billing disputes, email billing@xalgorix.com within 14 days.

Question 12

What payment methods do you accept?

Accepted Answer

All major credit and debit cards, as well as cryptocurrency (USDT, USDC, Monero, Bitcoin, Ethereum, and 200+ coins). Annual ACH/wire invoicing is available on Teams / Enterprise plans — contact sales@xalgorix.com.

Question 13

Can I pay with cryptocurrency?

Accepted Answer

Yes. You can purchase subscription plans and credit packs using cryptocurrency (including USDT, USDC, Monero, Bitcoin, and Ethereum). Plans and credits activate immediately upon on-chain confirmation.

Question 14

How do credits work?

Accepted Answer

Single scan = 1 credit. Wildcard scan = 1 credit per live subdomain, charged upfront when the scan starts and only refunded if the scan fails.

Question 15

What counts as one scan?

Accepted Answer

For Single, one target running through every selected phase. For Wildcard, you're billed per live subdomain discovered during recon — if recon finds 8 hosts but only 3 resolve and respond, you pay 3 credits. A completed wildcard scan costs at least 1 credit even if no subdomains respond.

Question 16

Do unused subscription credits roll over?

Accepted Answer

Yes — unused subscription credits carry over to the next billing cycle, and your monthly allowance is added on top each renewal. One-time pack credits never expire either.

Question 17

What's the concurrent scan limit?

Accepted Answer

Hacker runs 1 scan at a time, Pro runs 3, and Max runs 5 (with custom concurrency available for Teams / Enterprise). New scans queue automatically once you hit your plan's ceiling and start as soon as a slot frees up. Upgrades raise the limit immediately.

Question 18

What happens if I run out of credits?

Accepted Answer

New scans are blocked until you top up. You can buy a one-time credit pack from the Billing page (delivered instantly) or upgrade your plan for a larger monthly allowance plus higher concurrency.

Question 19

Do you offer a free trial?

Accepted Answer

We offer one-time credit packs starting at $10 for 10 scans — no subscription required, and credits never expire. All packs unlock the full 22-phase methodology.

Question 20

Is it safe to run Xalgorix against production applications?

Accepted Answer

Yes. Xalgorix uses non-destructive proof-of-exploitation payloads. It verifies vulnerabilities (such as authorization bypasses, SQL injections, or secret leaks) by proving the vulnerability path without modifying or destroying application state, dropping database tables, or performing denial-of-service. Built-in rate limiting and an instant kill switch protect your infrastructure.

Question 21

Can I use Xalgorix reports for SOC 2, ISO 27001, or vendor security reviews?

Accepted Answer

Yes. Xalgorix produces audit-grade executive and technical PDF reports complete with timestamps, tested endpoints, OWASP/CWE taxonomy, methodology disclosures, and proof-of-concept evidence. Many founders and engineering teams use Xalgorix to satisfy annual pentest requirements and clear vendor security questionnaires (VSQs) with enterprise procurement.

Question 22

Can I scan a target I don't own?

Accepted Answer

No. You must have explicit written authorization for every target you submit. We log target ownership confirmations and revoke accounts that violate the AUP.

Feature	Hacker	Pro	Max
Monthly scan credits	75 / mo	220 / mo	600 / mo
Concurrent scans	2	4	6
Effective unit cost	$0.65 / credit	$0.54 / credit	$0.46 / credit
Scan modes	Single, Wildcard	Single, Wildcard	Single, Wildcard
All 22 offensive phases	✓	✓	✓
Exploit-verified findings	✓	✓	✓
Findings retention	90 days (Standard)	180 days (Longer)	365 days (Extended)
Report formatting	Standard PDF/HTML	Custom-branded PDF	White-label PDF
Public share links	✓	✓ + Password protection	✓ + Password protection
Scheduled recurring scans	—	Daily	Daily & on-demand
CI/CD integrations & webhooks	—	✓	✓
Slack & Discord alerts	—	✓	✓
Execution queue	Standard queue	Priority queue	Priority execution
API access	—	Standard API	Full API & higher rate limits
Support	Email · 48h	Priority email · 24h	Priority email & chat · 12h

Autonomous security testing that scales with you

Choose how you use Cloud

Subscriptions

Credit packs

Subscriptions

Credit packs

Compare plans

Pricing FAQ

Need a private deployment?