* I got the same two errors and they were completely benign. The directory traversal problem was just Wordpress returning some data. The "interesting file" was a blog post that had some SQL in it. I'm not sure if they're the same that you found. But if I would have paid for the scan and they turned out to be the same two errors, I would have been pretty angry.
* Skipfish came back with some actual interesting things like embedded scripts and forms without xsrf protection. The embedded scripts were ok (ad/tracking codes), but the forms would have been an interesting thing to note.
Yes, I use skipfish for some tests, though I customized parts of it (it has an amazing web crawler). I also use proprietary scan technology, and plan to add a few more open source tools into the mix (such as port/service and virus scanning) in the not so distant future to create one combined risk/vulnerability report.
interesting file is typically a text file, unsecured htaccess file, or sometimes 500 error messages. If you tell me your site, I will check for you.
target market is small business, medium size business, or individual site owners - mostly those who don't maintain a full time IT security staff but want some visibility into their site risks. Eventually I may add PCI checks, but that is a huge compliance/paper cost which is tough for a one man shop to keep up with.
To me, that just seems scammy. As in "click here for your free credit report... oh! We've found problems. Pay to see what they are!"
Looking through my web server logs I'm not quite sure what the problems are, or how you determined I had the problem. Did I maybe return an error message with a 200 status code instead of a 403 forbidden? I've got some redirects on my site, did you take the 301 as a bad sign?
Looks like you're using skipfish for the scanning engine?
Who is your target market? I could see companies using something like this to fill the box on PCI compliance, but would need a lot more control over the report (eg "get rid of that low category") and would need a lot more details about how the scan was performed in order to satisfy an auditor. People who just want to display a seal on their signup page will want something a lot more low key, and already have lower cost options.