Know Your Attack Surface.

Our scanner combines deterministic detectors (TLS protocol checks, header parsing, regex-based secret scanning) with an LLM triage step that filters false positives. You'll see a confidence level (Confirmed / Likely / Possible) on every finding so you can prioritize. False positives do happen — the AI triage minimizes them but does not eliminate them.

All 10 categories of OWASP Top 10 2025, plus PCI DSS 4.0, NIST CSF 2.0, and ISO 27001 (mapped, not certified). Each finding is tagged with the OWASP ID and you can download a compliance report for your auditor.

AI triage is what we still ship: an LLM reads every raw finding, filters out false positives, ranks them by real-world risk, and assigns a confidence score. AI code-fix generation (the long-form patch generation step) was retired in mid-2026 — the output kept failing JSON validation because models kept embedding unescaped newlines in code samples. We surface short remediation guidance instead, which is reliable and easy to act on.

It's faster, cheaper, and more consistent — but it does NOT replace a human pentester. We cover the same attack surfaces (headers, TLS, XSS, SQLi, secrets, CORS, cookies, exposed paths, ports, JS CVEs) and we run continuously so you can detect regressions. A manual pentest adds business-logic testing, chained exploit chains, and adversarial creativity. Use us for the 90% of issues you can catch automatically; hire a pentester for the 10% that requires human reasoning.

We store scan results so you can view them later (Pro + Business tiers) and so you can re-scan the same URL and diff the results. We never sell scan data. We never share findings with third parties. You can export all your data as JSON or delete your account at any time from Settings.

Yes — within 14 days of any charge, email us and we'll refund the most recent payment, no questions asked. Cancel anytime from Settings; you keep access until the end of the current billing period.