Use our name and mark, properly.
Everything here is free to use when writing about AppScan, listing us in a directory, or putting us on a slide. Please do not restyle the mark, and please do not imply we endorse something we have not.
The mark and the wordmark
SVG, so it scales anywhere. The mark is a shield with a single detection inside it - the product in one glyph. Keep clear space of at least the height of the shield around it.
- · Use the supplied files, at any size where the shield stays legible.
- · Put the light mark on light surfaces and the dark mark on dark ones.
- · Use the single-colour mark when you only have one ink.
- · Recolour, rotate, outline or add effects to the mark.
- · Set the name in another typeface and call it the wordmark.
- · Combine our mark with yours into a single lockup.
Seven colours, each with a job
Severity colours are reserved for severity. Nothing decorative is ever ember or moss, because on a security screen those two mean something.
Inter and JetBrains Mono
Inter sets everything a person reads; JetBrains Mono sets everything a machine wrote - rule ids, file paths, code, credit counts. The distinction is load-bearing: if it is in mono, it came from the system exactly as printed.
How we write
Say what happened. “Your Stripe key is in the repository”, not “critical exposure detected”.
Every claim points at the thing that proves it. No number without a source.
We never invent a breach story to make a point. The real findings are frightening enough.
No invented customers, no borrowed logos, no testimonials nobody gave.
Show the dark app on a light page
The application is dark; the site around it is paper. If you need a screenshot for an article, this is the composition to reach for - and you are welcome to capture it straight from this page.
- Criticalsource.secrets.credential-committedA Stripe secret key is committed to the repository
- Criticalsource.injection.sql-built-from-inputSQL is built from request input in findOrders
- Highbrowser.network.data-readable-unauthenticatedOrders API answers without a session
- Mediumruntime.headers.csp-missing-or-unsafeContent-Security-Policy allows inline scripts
- ✓Reaching the site
- ✓Checking HTTPS
- ✓Detecting the stack
- ✓Inspecting security headers
- ✓Checking cookies
- ✓Reading DNS and mail records
- ·Reading the page head and structure
- ·Reading robots.txt, sitemaps and security.txt
9 unchanged findings inherited from main, not raised again.
One broke in this change: tenant scope removed from a lookup.
One paragraph you can paste
AppScan.sh is an application security platform for people who build software faster than they can review it. It scans a live application from its URL with 249 deterministic rules (110 of them free), connects to the repository behind it to classify every push and give every pull request a verdict, correlates what it sees at runtime with the code that caused it so one problem is one finding, and uses AI only where a person asks for it - to explain a finding or to open a draft pull request that fixes it.
The details, checkable
- Name
- AppScan.sh - one word, capital A and S. Never “App Scan” or “Appscan”.
- What it is
- An application security platform for people who ship fast: a live scan from a URL, continuous monitoring on GitHub, and AI-written fixes you review.
- Who it is for
- Solo builders, AI-assisted developers, freelancers, agencies and small product teams.
- Rules
- 249 deterministic detection rules across live site, real browser, source code and infrastructure.
- Pipeline
- 25 stages, each producing structured evidence rather than one large AI pass.
- Pricing
- Free public scans, no account required. Pro $29/month, Studio $49, Agency $99, Team by arrangement.
- Press contact
- press@appscan.sh
Writing about us?
Tell us what you need and we will get it to you: a quote, a walkthrough, a scan of something you choose.