Ownership before any active test
A DNS TXT record, a token file at a well-known path, a meta tag, an email or an API callback proves the target is yours; the platform refuses to self-authorise.
Read moreSecurity testing · updated 2026-10-05
Security testing with evidence bundles
Scans only against targets you have proven you own, 60+ engines across the OWASP Top 10 (2025) and API Top 10, and evidence on every confirmed finding.
For: Security engineers, AppSec teams and compliance owners who need findings an auditor can replay, inside the release pipeline rather than once a year.
Capabilities
OWASP coverage, sixty-plus engines
The OWASP Top 10 (2025) and the OWASP API Security Top 10, reported in their vocabulary, each result labelled confirmed or observed.
Evidence bundles
Request, response, proof of concept, scope and an integrity badge showing the bundle was not edited after the scan.
Read moreCode, secrets and dependencies
Static checks, secret detection, dependency and SBOM review and container checks alongside the dynamic scan.
Gated agentic testing
Exploitation steps require an explicit, signed authorisation record for the target and are decided on the server; every decision is in the audit log.
Gates in the pipeline
Fail a build on confirmed findings above a severity you choose; observations never block a release on their own.
Read moreHow it works
- Prove you own the targetAdd the DNS record, the token file or the meta tag; the platform verifies it.
- Choose the scopeThe recorded flows, the API collection or the host; which engines; how deep.
- Run in the pipeline or on demandFrom CI with a severity gate, or from the dashboard.
- Review confirmed findings with their evidenceReplay the proof of concept, assign, fix, re-scan.
What you receive, and what we do not do
Evidence ledger
- Per confirmed finding
- The request, the response, a proof of concept, severity with CVSS, scope and an integrity badge.
- Per observation
- The pattern seen and why it was not proven; never a gate failure on its own.
- Per scan
- Scope, engines run, duration, the ownership proof used, and who authorised what.
Limits we state
- Only targets you can prove you own; there is no way to scan a third party through the platform.
- Exploitation needs an explicit authorisation record and is withheld in markets where the law makes it unsafe to offer; scanning and recording remain available there.
- This is a scanner with evidence, not a managed penetration test; no human tester is included.
- Observations are reported for your judgement and never fail a quality gate.
Plans: Free includes 10 security scans a month; Solo Pro 100; Team 500, pooled; Enterprise unlimited. See the metering table.
Questions buyers ask
How is a confirmed finding different from an observation?
A confirmed finding carries the request, the response and a proof of concept you can replay. An observation is a pattern that looks risky but was not proven, such as a missing header; it is reported and labelled, and never fails a gate on its own.
Can the platform scan a site we do not own?
No. Active tests run only against targets whose ownership has been proven for the workspace, and exploitation needs a separate signed authorisation record. This is deliberate: it is what makes a finding defensible in your own review.
Does anything from the scan go to an AI provider?
No. Triage and analysis run on local models inside the platform; the findings and their evidence stay in your tenant.
Try it on your own application
The Free plan has no time limit and asks for no card. Or bring one flow from your product and we record it live.