# AX Check: securitypal.com Checked 2026-09-18. Pricing stays hidden — agents can't get a number, only "contact sales." All 3 independent agent sessions ended unable to state a dollar figure for any tier; each explicitly refused to guess and pointed to sales contact instead. ## Onboarding needs a login ## Coding sessions All three sessions (DeepSeek V4 Pro, Kimi K3, Qwen 3.8 Max) completed their task but found no published pricing. Each explicitly declined to invent a number, saying pricing is unpublished and directing to contact sales for a quote instead. ### DeepSeek V4 Pro [View public run](https://agents.withgauge.com/p/runs/ef9471e7-a2e7-4339-a001-eef3e94a166f) · [Read transcript](https://www.ax-check.com/securitypal.com/sessions/deepseek.json) Final output never states an actual cost figure — it explicitly refuses to quote a number ('I won't quote numbers from them... contact sales for a quote'), so there is no price stated to attach assumptions to. #### End-to-end onboarding - **End-to-end onboarding not demonstrated**: The agent never obtained or used product credentials. It found no public developer portal, SDK package, or documented API for SecurityPal, and explicitly declined to attempt authentication against the internal SPA's private endpoints. No credential acquisition or authenticated product operation occurred. Event 107: ```text SecurityPal does not expose a public developer workflow I could build against as a self-serve SDK/API user. ``` Event 107: ```text The only real API is the **internal one behind their SPA** at `app.securitypalhq.com` (`/api/answer-library/...`, `/api/analytics-dashboard/...`, etc.). It's undocumented, requires their session/OAuth auth, and has no public API-key flow — not something a third party can build a legitimate example against. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No public API, SDK, or developer docs exist for SecurityPal**: Product behavior/limitation, not agent error: every plausible developer surface (docs., developers., api., /api, /developers, /docs, /api-docs) returned 404 or DNS failure, and no SDK exists on npm or PyPI. The only functioning API is undocumented and lives behind the authenticated web app, with no public API-key signup flow. This is a genuine absence of a self-serve developer workflow, confirmed through direct probing rather than assumption. Event 25: ```text == https://docs.securitypalhq.com 000 https://docs.securitypalhq.com/ == https://developers.securitypalhq.com 000 https://developers.securitypalhq.com/ == https://api.securitypalhq.com 404 https://api.securitypalhq.com/ ``` Event 67: ```text 000 https://help.securitypalhq.com 000 https://support.securitypalhq.com 403 https://securitypal.zendesk.com 403 https://securitypalhq.zendesk.com 404 https://intercom.help/securitypal 404 https://www.securitypalhq.com/help 404 https://www.securitypalhq.com/api-docs 404 https://www.securitypalhq.com/docs ``` Event 34: ```text {"objects":[],"total":0,"time":"2026-09-18T21:27:45.442Z"} ``` - **No self-serve pricing information published**: Product behavior: the /pricing URL redirects to the general platform marketing page, and every call-to-action across the site funnels to a sales demo rather than a plan selector or signup, preventing the agent from reporting concrete pricing. Event 107: ```text There is **no public pricing page** and **no self-serve plan**. Their `/pricing` URL just redirects to the platform page, and the only CTA everywhere is **"Get a Demo" / "Book a Demo."** ``` #### Suggested Changes - **Publish a developer/API documentation page**: Add a docs.securitypalhq.com or /developers page describing any available API/SDK and authentication flow. Verify by re-running the same probes (docs., developers., /api, /developers, /docs) and confirming they return real content instead of 404/DNS failures. Event 25: ```text == https://www.securitypalhq.com/developers 404 https://www.securitypalhq.com/developers ``` Event 98: ```text 200 /api/docs 000 https://docs.securitypalhq.com -> 000 https://securitypalhq.readme.io -> 404 https://support.securitypalhq.com -> 000 https://knowledge.securitypalhq.com -> 000 ``` Event 55: ```text {"objects":[],"total":0,"time":"2026-09-18T21:28:45.447Z"} ``` Event 26: ```text == https://app.securitypalhq.com/api-docs/swagger.json ``` - **API tokens only issued to paying customers via sales**: Agent found in the frontend bundle that API token management is a permissioned in-app feature (concierge-create-api-tokens etc.) and that account creation is gated, meaning no way to self-serve a credential without a sales/contract process. This is a missing-credentials blocker rooted in product design (enterprise sales-led access), not a test environment issue. Event 34: ```text e.CONCIERGE_DELETE_API_TOKENS="concierge-delete-api-tokens",e.CONCIERGE_REVOKE_API_TOKENS="concierge-revoke-api-tokens",e.CONCIERGE_VIEW_API_TOKENS="concierge-view-api-tokens" ``` Event 47: ```text signup: 200 health: 200 Book a Demo ``` Event 57: ```text **Blocked at: account/API credential acquisition.** ``` - **No published pricing page**: The /pricing URL redirects to /platform, which only offers a 'Book a Demo' call-to-action rather than listing rates, preventing the agent from reporting actual pricing figures. Event 22: ```text https://www.securitypalhq.com/platform 200 ``` Event 47: ```text Book a Demo ``` #### Suggested Changes - **Publish a public API reference outside the authenticated app**: Currently /api-docs on app.securitypalhq.com returns the same gated React shell whether or not the visitor is logged in, and the permission model shows API docs viewing is a customer-only privilege (view-api-docs). Move a read-only API reference (even just endpoint list/auth flow) to a public path like www.securitypalhq.com/developers, and verify by curling it unauthenticated and confirming real documentation content is returned instead of the app shell. Event 22: ```text ``` Event 34: ```text e.VIEW_API_DOCS="view-api-docs" ``` Event 16: ```text https://www.securitypalhq.com/developers -> 404 ``` - **Publish pricing details instead of redirecting to a demo CTA**: The /pricing route 301-redirects to /platform, which shows only a 'Book a Demo' button with no tiers or numbers. Add a pricing section with at least indicative tiers to /platform or restore a dedicated /pricing page, and verify by checking that fetched HTML contains dollar amounts or tier names instead of only a demo CTA. Event 22: ```text https://www.securitypalhq.com/platform 200 ``` Event 47: ```text Book a Demo ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/3fe653a7-a656-4a50-be0b-cceda103ad21) · [Read transcript](https://www.ax-check.com/securitypal.com/sessions/qwen.json) Final output explicitly refuses to give a cost figure ('I can't tell you a number... I won't invent one') — no dollar amount or cost estimate with assumptions is ever stated, only that pricing is unpublished/sales-negotiated. #### End-to-end onboarding - **Onboarding needs a login**: Agent never obtained or used real SecurityPal credentials. It only probed public marketing/docs surfaces via read-only curl requests, found no SDK, API, or docs, and identified that the only application entry point (app.securitypalhq.com/login) is gated behind a login it had no credentials for. It then stopped without attempting any authenticated operation. Event 33: ```text https://app.securitypalhq.com/login ``` Event 46: ```text No API keys or credentials in this environment, and `/sandbox/repo` is an empty workspace (only `.gitignore` + one "Initial workspace" commit), so there's no existing integration code to extend either. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No public SDK, API, or docs found for SecurityPal**: Agent searched npm, PyPI, and the marketing site for any developer surface (SDK packages, /docs, /api, /developers, /integrations paths) and got 404s or 'Not found' everywhere. This is a genuine product limitation (or at least a discoverability gap) rather than agent error or environment issue — SecurityPal appears to be a managed SaaS + human-service product without a self-serve developer platform. Event 17: ```text securitypal -> {"error":"Not found"} security-pal -> {"error":"Not found"} @securitypal/sdk -> {"error":"Not found"} securitypal-python -> {"error":"Not found"} securitypal-sdk -> {"error":"Not found"} ``` Event 34: ```text developers -> 404 docs -> 404 api -> 404 developer -> 404 integrations -> 404 ``` - **Only application entry point is login-gated with no credentials available**: The sole product access point found (app.securitypalhq.com/login) requires human login credentials that were not present in the sandbox environment. This is a normal login requirement, not a product defect, but it fully blocked any authenticated action. Event 33: ```text https://app.securitypalhq.com/login ``` Event 46: ```text No API keys or credentials in this environment ``` - **No pricing figures published; only sales-quoted tiers**: The /pricing URL redirects to a feature-tier brochure page with no dollar amounts, forcing the agent to conclude pricing is sales-negotiated rather than self-service, which combined with the missing dev surface, ended the build attempt entirely. Event 40: ```text pricing->https://www.securitypalhq.com/solutions/cax-suite-tiers ``` Event 46: ```text every CTA is "Get a Demo" / "Get started now". So pricing is sales-negotiated, quoted per tier/seat/volume ``` #### Suggested Changes - **Publish a developer docs subdomain or API reference**: docs.securitypal.com and app.securitypal.com both return 404, and no /docs, /api, or /developers path exists on the marketing site (securitypalhq.com). Add a public developer documentation page linked from the main site nav; verify by confirming a GET request to the docs URL returns real content instead of a 404. Event 34: ```text docs -> 404 api -> 404 developer -> 404 ``` - **List SecurityPal SDK packages on npm or PyPI, or state there is none**: Searches for securitypal, security-pal, @securitypal/sdk, securitypal-sdk on npm and securitypal on PyPI all returned Not Found. If an SDK exists, publish it under a discoverable package name; if none exists, add a note on the site clarifying integration is via web app/account team only so developers do not waste time searching. Event 17: ```text securitypal -> {"error":"Not found"} security-pal -> {"error":"Not found"} @securitypal/sdk -> {"error":"Not found"} securitypal-python -> {"error":"Not found"} securitypal-sdk -> {"error":"Not found"} ``` - **Show actual pricing numbers on the pricing page**: The /pricing redirect lands on /solutions/cax-suite-tiers, a tier-feature comparison with zero dollar amounts and only 'Get a Demo' CTAs. Add at least indicative starting prices or a self-serve tier to that page; verify by grepping the rendered page for a currency figure. Event 44: ```text Assurance Management Platform Comprehensive Solutions for Modern Security, GRC, and GTM Teams AMPlify customer assurance with SecurityPal’s Cybersecurity Assurance Management Platform (CAMP) ``` ### Task given to each agent Help me build a simple example using SecurityPal. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: F · 14/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Failed** — Homepage answers Markdown requests ```text Homepage returned text/html for a Markdown request; no Markdown representation offered. ``` - **Skipped** — llms.txt provides an actionable documentation index ```text llms.txt request timed out; no body retrieved to judge index quality. ``` - **Skipped** — llms.txt provides navigation guidance ```text llms.txt request timed out; no content available to assess navigation guidance. ``` - **Skipped** — llms.txt mentions offered API, MCP, and skills ```text llms.txt request timed out; cannot confirm mentions of API, MCP, or skills. ``` - **Skipped** — A compact guide representation exists ```text No site-published Markdown guide fetched; only HTML pages and a timed-out llms.txt. ``` - **Skipped** — A focused guide is directly retrievable ```text No compact Markdown guide was retrieved; llms.txt request timed out. ``` - **Skipped** — Equivalent instructions fit a token budget ```text No Markdown guide fetched, so token budget cannot be measured. ``` - **Skipped** — Product-docs links survive format changes ```text Homepage Markdown unsupported, so link preservation across formats is unassessed. ``` - **Skipped** — The compact guide is independently actionable ```text No compact agent guide or standalone Markdown page was fetched; only HTML marketing pages. ``` - **Pass** — Install and next-step links resolve ```text Get-started page and its demo anchor fetched successfully; no broken install or next-step links observed. ``` ### Onboarding - **Skipped** — Docs lead to a relevant quickstart ```text Only a demo-request 'Get Started' page was fetched; no developer docs or quickstart found. ``` - **Skipped** — Installation commands are extractable ```text No installation or CLI/SDK setup instructions appear in the fetched pages. ``` - **Skipped** — Code examples are available without interaction ```text Fetched pages contain no code examples; product is a managed SaaS platform. ``` - **Skipped** — Prerequisites and auth boundaries are explicit ```text No API, auth, or prerequisite documentation was fetched for this product. ``` ### Pricing - **Failed** — Agents identify pricing and its assumptions ```text 3 of 3 sessions were judged on pricing; 3 fell short. DeepSeek V4 Pro: Final output never states an actual cost figure — it explicitly refuses to quote a number ('I won't quote numbers from them... contact sales for a quote'), so there is no price stated to attach assumptions to. Kimi K3: Final output states 'There is no public pricing... nothing is published, so I can't confirm numbers' — no cost figure is ever stated, only a vague unverified historical claim, so no priced-with-assumptions statement exists. Qwen 3.8 Max: Final output explicitly refuses to give a cost figure ('I can't tell you a number... I won't invent one') — no dollar amount or cost estimate with assumptions is ever stated, only that pricing is unpublished/sales-negotiated. This behavioural item does not affect the fast grade. ``` - **Skipped** — Pricing is readable without interaction ```text Homepage shows only tier names Basecamp, Summit, Everest with $ symbols, no readable prices. ``` - **Skipped** — Prices are stated, not gated ```text No pricing page fetched; homepage tiers show $ symbols but no stated dollar amounts. ``` - **Skipped** — Pricing units and limits are explicit ```text No pricing page fetched; homepage tiers lack explicit units or usage limits. ``` ### Activation - **Skipped** — An API reference or OpenAPI spec is reachable ```text No API reference or OpenAPI spec was fetched; only marketing pages were collected. ``` - **Skipped** — An MCP server is documented and well-formed ```text No MCP server documentation appears in the fetched SecurityPal pages. ``` - **Skipped** — A CLI install path is documented ```text No CLI install path is documented in the fetched pages. ``` - **Skipped** — SDK packages resolve on their registries ```text No SDK package registry lookup was supplied for SecurityPal. ``` - **Skipped** — Agent skills are published ```text No agent skills are published or referenced in the fetched pages. ``` [Full report data](https://www.ax-check.com/securitypal.com/report.json)