Engineered for Clarity
A transparent breakdown of supported assessments, host-level telemetry, and repository analysis — with the exact inspection boundaries of each mode, so you know what runs before you connect a target.
Three modes, three levels of access
Every mode is scoped so it can’t put your production stability at risk.
Host Agent Telemetry
A lightweight read-only agent you enroll on your Linux server. It reports internal telemetry to the platform for assessment.
- check_circle Read-only, no inbound listening ports
- check_circle Per-asset scoping with revocable grants
- check_circle Enrolled via a one-time bootstrap token
Repository & Manifest Analysis
Offline inspection of build manifests and lockfiles — composer.lock, package-lock.json, Python project files — to inventory your dependency tree before deploy.
- check_circle Dependency inventory with vulnerable-package flags
- check_circle Hardcoded secret detection with redaction
- check_circle Zero production execution required
Dependency advisories are inventory-level; automated CVE confirmation against advisory sources is on our roadmap.
External Perimeter Checks
Non-destructive evaluation of your publicly reachable endpoints — exposure status of sensitive paths and your HTTP response security headers.
- check_circle Exposed dotfiles — accessibility status only, no content stored
- check_circle HTTP security header review
- check_circle Requires verified ownership (DNS TXT or HTTPS token)
Exact Inspection Boundaries
You will never encounter unexpected outages or deceptive capability claims here.
check_box What we check
- done Known public misconfigurations: accidental exposure of
.git/,.env, config backups, and database dumps. - done Client-side security directives: incomplete CSP, permissive CORS, missing frame guards.
- done Debug exposure: whether error responses leak stack traces on public routes.
- done Dependency inventory: lockfile parsing across PHP, Node, and Python projects.
- done Host-level anomalies: via the read-only agent where you enroll one.
block What we do not do
- remove No exploit execution: never payloads, injection fuzzing, or load tests against your target.
- remove No production data infiltration: we never download or store private database rows or customer data.
- remove No deep file scanning without an agent: malware and webshell inspection needs host access.
- remove No auto-fixing: we deliver exact remediation guidance; you keep full control.
Technical Capabilities
Actionable remediation guidance without alert fatigue.
Cryptographic ownership verification
Eliminate unauthorized reconnaissance. Every target must pass a DNS TXT or well-known-file challenge before any probe runs against it.
Redacted evidence
When a check touches sensitive material, the evidence stored and shown is redacted at ingestion time — secrets, keys, and passwords are masked before persistence.
Plain-English impact summaries
Findings explain what an attacker could do with the issue and how to explain the risk to stakeholders — no raw hex dumps.
Copy-paste remediation
Ready-to-apply configuration directives for Nginx and Apache resolve findings in minutes — no guessing header syntax.
FAQ
Will running a check degrade my web server performance or trigger 502 errors?
No. Assessment requests are passive, rate-limited reads — configuration paths, headers, and manifests. We never run aggressive fuzzing arrays against your endpoints.
Why is cryptographic domain ownership verification mandatory?
Unauthorized scanning of third parties is a liability. Requiring a DNS TXT record or an HTTPS token guarantees assessments are only initiated by the real infrastructure owner — zero third parties are probed without explicit permission.
How does the host agent operate and what privileges does it require?
It is a read-only agent you enroll on your server. It does not open inbound listening ports; it reports telemetry out to the platform, and its access is scoped per asset — you can revoke that grant at any time.
How do you handle sensitive credentials found in exposed files?
Exposed-file checks record the accessibility status, not the file contents. Where evidence snippets are collected, they are redacted at ingestion time — high-entropy values like passwords and keys are masked server-side before storage, so they never reach dashboards or reports.
See your own security posture
Register your target, verify ownership, and get your first assessment during the trial.
Start 7-Day Free Trial