Pricing

Your plan sets your ceilings: how many nodes, proxies, workspaces and wordlist storage you get, how many workflows you can run at once, how much concurrency and how large a single scan can be, and which capabilities are unlocked (authenticated scanning, BOLA / BFLA authorization testing, the managed OAST pool, missions, and browser-fingerprint mode). Scanning within those limits is unlimited and free. There are no per-scan fees and no metered minutes.

A personal plan is one operator: your own workspaces, your own arsenal, one login. An organization is a separate billing entity with member seats, teams and shared team workspaces, so the work survives someone leaving and every action is attributable to a person. You can hold a personal plan and also be a member of an organization at the same time; your team work is covered by the org.

No, and that is deliberate. The arsenal is flat and org-wide: every Syndicate org gets the same 50 nodes, 250 proxies and 200 wordlists whether it has three members or twenty. Your nodes are your own hardware and rationing them by headcount would be absurd. What a seat buys is a person: their access, their workspaces, their audit trail, plus 10 more concurrent workflows, because concurrency is the only part of this that costs us anything to run.

The product is identical. Syndicate is self-serve to 25 seats: you buy it yourself in a couple of minutes, you pick the term, and usage pauses rather than quietly overspending. Enterprise is for orgs past that size, or where billing has to be invoiced against a purchase order instead of paid up front. We provision your limits during onboarding and usage is non-blocking up to an agreed ceiling.

Any time, from billing settings. Paying yearly is cheaper per month: you get two months free, and a monthly plan can move to yearly at its next renewal. An upgrade takes effect at once, less what is left of the term you already paid for. Adding a seat is prorated and takes effect immediately; removing one takes effect at the end of the period, so you never lose access you have already paid for.

Only with written permission from its owner: a signed engagement, or a bug bounty program that lists it. The Acceptable Use Policy makes that a condition of using Crossfyre, and confirming it is up to you. Before the vulnerability engine injects into an endpoint, it checks that the host is the target you gave it or one you added to the workspace scope list yourself. If the scan turns up an endpoint on another host, such as a form that posts to a different site, that endpoint is skipped, and the scan log says so. It is also built around the rule that a scanner may not change the application it is measuring: a field that could set a password is removed before the engine injects into the form, and a GraphQL field called deleteEverything is reported, not called.