Update from code changes: document estimate scoping gate and quote email

white-box-pentest/billing.mdx

@@ -1,14 +1,14 @@
 ---
 title: "Credits and billing"
 description: "Understand Whitebox Scan credits, estimates, purchases, deductions, and refunds."
 ---
 
 Whitebox Scans use shared organization credits. A scan must have a completed or
 partial cost estimate with credits before it can start, and the organization
 needs enough credits for that estimate.
 
 <Info>
   Whitebox Scan credits are organization-wide. They are separate from Code
   Review seats, Automation credits, trials, and pooled PR/MR review limits.
 </Info>
 
@@ -16,12 +16,12 @@
 
 <Steps>
   <Step title="Calculate first">
     Hacktron calculates the credit cost from the selected repositories and
     scope. Cost calculation does not deduct credits.
   </Step>
   <Step title="Start with enough balance">
     Starting the scan deducts the calculated credits from the organization's
     Whitebox Scan credit balance. Internal unlimited organizations show
     unlimited credits and are not charged.
   </Step>
   <Step title="Track usage">
@@ -30,24 +30,58 @@
   </Step>
 </Steps>
 
+## Large estimates and scoping calls
+
+Estimates of up to 10,000 credits are self-service. Hacktron shows the credit
+total, and you can continue to checkout with **Next**.
+
+When an estimate is above 10,000 credits, Hacktron asks for a short scoping
+consultation before checkout:
+
+- The cost calculation step hides the credit total and per-repository credits.
+- **Next** is disabled, so you cannot start the scan from that estimate.
+- Hacktron follows up by email to confirm coverage, pricing, and timeline.
+- You can also book a scoping call. Organization owners with a work email can
+  open a shared Slack channel with Hacktron from **Settings**.
+
+The threshold compares the base scan credits. The optional or required triage
+fee is not counted toward the 10,000 credits. On-premises deployments do not
+use this gate.
+
+<Tip>
+  To stay within the self-service range, [narrow the included folders or path
+  patterns](/white-box-pentest/quickstart#path-patterns) and calculate the cost
+  again.
+</Tip>
+
+### Quote confirmation email
+
+After a hosted cost calculation completes with a credit cost, Hacktron emails
+the person who ran it. The subject is `Whitebox Pentest for <Organization>`.
+
+- For self-service estimates, the email states the quoted credits and their
+  USD value, with a link to book an optional scoping call.
+- For estimates above 10,000 credits, the email omits pricing and invites you
+  to reply or book a scoping call to confirm coverage, pricing, and timeline.
+
 ## Buy credits
 
 Organization owners can buy Whitebox Scan credits. If a member reaches checkout
 without enough credits, Hacktron asks them to contact an owner to top up the
 balance.
 
 Whitebox Scan Credits do not use auto top-up. Owners purchase them manually without changing the organization's Automation credit balance or its auto top-up settings.
 
 Owners need a saved payment method before purchasing credits. If there is no
 payment method on file, the checkout flow prompts the owner to add one first,
 then opens the credit purchase modal.
 
 Organization owners can buy credits from **Billing** or from the Whitebox Scan
 checkout step when the organization does not have enough credits.
 
 <Steps>
   <Step title="Open Billing">
     Go to **Billing** in the Hacktron dashboard and find the Whitebox Scan
     credit balance.
   </Step>
   <Step title="Add a payment method">
@@ -59,7 +93,7 @@
     price.
   </Step>
   <Step title="Complete checkout">
     Complete any required card authentication. Hacktron adds the purchased
     credits to the organization balance after checkout succeeds.
   </Step>
 </Steps>
@@ -79,7 +113,7 @@
 3. Start the scan again after the balance covers the calculation.
 
 API callers receive `402 Payment Required` when a scan cannot start because the
 organization has insufficient Whitebox Scan credits.
 
 <Tip>
   The API does not buy credits automatically. Handle `402` by directing an
@@ -89,20 +123,20 @@
 
 ## Retests
 
 Each pentest includes **one free retest**, with no extra Whitebox Scan credits
 deducted. See [Retests](/white-box-pentest/retests) for how to request it.
 
 ## Refunds and cancellations
 
 If a started scan cannot launch successfully after credits are deducted,
 Hacktron attempts to refund those credits automatically. Failed and stopped
 scans can show refunded credits in the scan details and transaction history.
 
 ## Related docs
 
 <Columns cols={2}>
   <Card
     title="Trigger a Whitebox Scan"
     icon="shield-halved"
     href="/api-reference/scans/create-scan"
   >

white-box-pentest/quickstart.mdx

@@ -1,9 +1,9 @@
 ---
 title: "Quickstart"
 description: "Prepare scope, estimate credits, and start a white-box pentest."
 ---
 
 Use this guide to prepare scope and start a White-box Pentest from the Hacktron
 dashboard.
 
 ## Prerequisites
@@ -11,10 +11,10 @@
 Before you start, make sure the organization has:
 
 - A connected repository or an uploaded archive to assess
 - The branch or commit you want Hacktron to use
 - For dynamic testing, the domains or URLs of the applications to test and
   instructions for accessing each one, even if no sign-in is required
 - Enough Whitebox Scan credits, or an organization owner who can add a payment
   method and buy credits
 
 <Card
@@ -111,6 +111,10 @@
     **Edit scope** to adjust the paths. Any scope change resets the estimate,
     so calculate again before starting.
 
+    If the estimate is above 10,000 credits, Hacktron hides the total, disables
+    **Next**, and follows up by email to scope the pentest with you. See
+    [Large estimates and scoping calls](/white-box-pentest/billing#large-estimates-and-scoping-calls).
+
     <img src="/images/whitebox_cost_estimate.png" width="2212" height="1256" alt="Run the credit cost estimate for the scan" />
 
   </Step>
@@ -195,24 +199,24 @@
 | Authentication      | Test credentials, SSO notes, MFA bypass instructions, or invite steps.             |
 | Sensitive areas     | Auth, billing, permissions, file upload, webhooks, AI agents, or admin paths.      |
 | Exclusions          | Systems, data, tenants, destructive actions, or rate limits that are out of scope. |
 | Context documents   | Architecture notes, threat models, API specs, or prior pentest reports.            |
 
 ## Other ways to start a pentest
 
 You can also prepare a pentest in Slack, through an AI assistant connected to
 Hacktron's MCP server, or through the REST API. Set the scope and review the
 credit estimate before starting. These options require an organization admin
 to start the pentest.
 
 <Columns cols={2}>
   <Card title="Hacktron in Slack" icon="slack" href="/platform/slack-assistant">
     Mention @Hacktron AI with a repository or an attached archive.
   </Card>
   <Card title="MCP" icon="plug" href="/mcp/get-started">
     Set up pentests from Claude, Cursor, and other AI assistants.
   </Card>
   <Card
     title="Create pentest draft"
     icon="code"
     href="/api-reference/pentests/create-pentest"
   >