// NIJITECH PRODUCT · SOFTWARE TESTING
SendTheCanary
SendTheCanary is an independent testing team that systematically pushes web, mobile and API products before they go live. Every finding is delivered with reproduction steps, a screen recording and a severity level.
Product site:sendthecanary.com
SendTheCanary is an independent software testing service founded in 2021 by three test engineers. A core team sets the scope, the test plan and the report; the scenarios are run by testers on their own devices in their own regions. It writes no code, sells no consulting and makes no fixes: it finds, proves and reports. Because the party that finds the bug is not the one that fixes it, verification stays independent.
Figures as published by SendTheCanary.
// SERVICES
Each service has its own checklist, its own tools and its own output. You choose which ones in the panel; they all merge into one report.
Flows that carry money and data, such as sign-up, login, cart, payment and cancellation, are tried end to end; written scenarios catch the known risks, exploratory testing catches what nobody thought of. The regression pack built on the first test is repeated exactly on every later release.
On a device-and-browser matrix derived from your user analytics, on real devices and real browser versions. Old iOS, low-memory Android and the legacy browsers of corporate environments included.
Core Web Vitals measurements, slow-connection scenarios and staged load testing with k6. The output is not a score: it shows which query, request or image is creating the bottleneck.
On the basis of the OWASP Top 10: authorisation bypass, horizontal and vertical privilege escalation, session management, insecure direct object references and input validation. Not a substitute for a penetration test; it targets the common, costly mistakes at the application layer.
Endpoints are validated against the schema; error codes, boundary values and concurrency are pushed. For payment, 3-D Secure, bank declines, timeouts, double submission, partial refunds and subscription renewals are tried with real cards and real bank responses.
Keyboard, focus order, screen reader and contrast are tested by hand against WCAG 2.2 AA. Flows that work but wear people down come as a friction report, each item with a recommendation. For localisation the product is tried in the target country with a native-speaking tester.
Every one of these steps runs on the same backbone: the niji core pipeline →
// PROCESS
The whole process is followed from the panel: how many testers are working, which scenario passed, which finding just landed. The typical Release-package timeline is below; Discovery closes at 72 hours, Fleet repeats on every release.
Hours 0–4. Which services, how many platforms, which devices; start from a ready package or build the scope by hand. Output: scope summary. Sign-up is free.
Hours 4–12. Payment is taken only once the scope is approved. The core team writes the test plan; what will not be tested is stated in writing too.
Hours 12–72. The number of assigned testers, their devices and the scenario each is on right now are live in the panel. Every verified finding lands in the panel without waiting for the report; a daily summary arrives.
Hours 72–84. A prioritised inspection report and PDF, signed by a named person. Every finding carries reproduction steps, video and a console log. Jira / Linear export on Release and Fleet.
Hours 84–120. When the fix ships, a re-test is requested from the panel; closed and still-open items are updated in the same place. One round on Discovery, two on Release; unlimited on Fleet. Data is deleted 90 days after the test ends.
// FREQUENTLY ASKED QUESTIONS
The inspection report is delivered at hour 72; on the Release and Fleet packages the first report arrives within 48 hours. The remaining time is the re-test of your fixes. If a critical finding comes up, you are told immediately rather than at report time.
Web, mobile and API products. There are ten service lines: functional, regression, compatibility matrix, performance and load, security audit, API, payment, accessibility, usability and localisation. You choose which ones in the panel; the outputs merge into a single report.
No. The audit focuses on authorisation, session and input-validation weaknesses on the basis of the OWASP Top 10, targeting the common and costly mistakes at the application layer. A full penetration test is a separate engagement.
Every finding comes with reproduction steps, a screen recording, a console log, environment details and a severity level. Findings land in the panel before the report is finished; on the Release and Fleet packages they are exported straight to Jira or Linear.
There are three standard packages: Discovery (one product, one test, 72 hours), Release (the whole product, three platforms, pre-launch) and Fleet (regression on every release, monthly, six-month commitment). For regulated industries the Enterprise option comes with a custom SLA. Sign-up is free; you pay only once you approve the scope. Current prices are on SendTheCanary’s own site.
Yes. A device-and-browser matrix is derived from your user analytics and the tests run on that matrix, on real devices and real browser versions. Old iOS versions, low-memory Android devices and the legacy browsers of corporate environments are included; an emulator alone is not considered enough.
Yes. 3-D Secure, bank declines, timeouts, double submission, partial refunds and subscription renewals are tried with real cards and real bank responses. A sandbox shows everything working; what appears when money actually moves is caught here.
Work is done under NDA. Test data, recordings and access credentials are permanently deleted 90 days after the test ends. Whatever is out of scope is stated in writing up front; without a boundary on scope, neither the price nor the delivery date means anything.
SendTheCanary again. When you ship the fix you request a re-test from the panel; items that closed and items that did not are updated in the same place. Discovery includes one re-test round, Release two; Fleet is unlimited. Because the party that finds the bug is not the party that fixes it, verification stays independent.
GET STARTED
Let us work out together how it fits your current infrastructure, how a migration would run and which plan suits your business.
Talk to the team →We would like to use Google Analytics to understand how the site is used. It sets cookies and transfers data to the United States. The site works exactly the same if you decline.
