AppScan
Coverage

All 249 rules. Printed, not promised.

Security vendors like to say “thousands of checks”. Here is the actual list, with the id each rule stamps onto the finding it raises, so you can check any claim on this site against a real result.

Run them on my app How the scan runs
62
Live site

What an anonymous visitor can reach. No account, no agent, nothing installed.

52
Real browser

A headless Chromium walks your routes, cold and through client navigation, and records every request it makes.

52
Source code

Taint analysis over your TypeScript, the protections a file can switch off, secrets, and dependency advisories for npm, PyPI, Go, RubyGems, Packagist, crates.io and Maven.

38
Infrastructure

The files that decide how your app is actually deployed, and the pipeline that deploys it.

21
Code improve

How easy the code is to change, measured against the bar we hold our own code to: duplicated functions, constants scattered across files, files and functions grown past reading, calls made one at a time that could be one, boundaries crossed by an import, exports nobody uses. Shown in its own section and never counted as a security issue.

24
Read by a model

The files the analyzers above cannot open - Python, Go, Java, Ruby, PHP, Rust - read by a model, and anything it flags checked again by a second one before it reaches you. The first eight are defects; the rest are things worth doing, kept apart because a suggestion should never be dressed as a vulnerability. Optional, paid in credits, and it reports nothing unless both models agree.

What an anonymous visitor can reach. No account, no agent, nothing installed.

  • HTTPS is not available
    free
    runtime.transport.https-unavailable
  • HTTP is not redirected to HTTPS
    free
    runtime.transport.http-not-redirected
  • Certificate is invalid
    free
    runtime.transport.certificate-invalid
  • Certificate expires soon
    free
    runtime.transport.certificate-expiring
  • HTTPS page loads HTTP resources
    free
    runtime.transport.mixed-content
  • Content-Security-Policy missing or unsafe
    free
    runtime.headers.csp-missing-or-unsafe
  • HSTS missing or too weak
    free
    runtime.headers.hsts-missing-or-weak
  • Page can be framed by anyone
    free
    runtime.headers.clickjacking-unprotected
  • MIME sniffing is not disabled
    free
    runtime.headers.x-content-type-options-missing
  • Referrer policy leaks URLs
    free
    runtime.headers.referrer-policy-missing
  • Permissions-Policy not set
    free
    runtime.headers.permissions-policy-missing
  • COOP missing
    free
    runtime.headers.cross-origin-opener-policy-missing
  • CORP missing
    free
    runtime.headers.cross-origin-resource-policy-missing
  • Server version disclosed
    free
    runtime.headers.server-version-disclosure
  • Session cookie without Secure / HttpOnly / SameSite
    free
    runtime.cookies.sensitive-cookie-unprotected
  • CORS reflects any origin with credentials
    free
    runtime.cors.dangerous-origin-policy
  • Credential shipped in public JavaScript
    free
    runtime.javascript.credential-exposed
  • Source maps published
    free
    runtime.javascript.source-map-exposed
  • Software in use no longer receives security updates
    free
    runtime.technology.end-of-life
  • A library the page loads has a published vulnerability
    free
    runtime.technology.known-vulnerable-version
  • Exposed .env, .git, backups, dev tools
    free
    runtime.exposure.sensitive-path-public
  • Data backend reachable from the browser
    free
    runtime.exposure.browser-data-backend
  • CDN code loads without an integrity hash
    free
    runtime.html.subresource-integrity-missing
  • Production page points at a dev host
    free
    runtime.html.internal-host-referenced
  • Embedded frame granted camera, mic or location
    free
    runtime.html.iframe-delegates-device-access
  • A form submits to another company
    free
    runtime.html.form-posts-cross-origin
  • CSP only in markup, not in the response
    free
    runtime.html.csp-only-in-meta
  • Session cookie without a __Host- name
    free
    runtime.cookies.missing-host-prefix
  • Session cookie shared with every subdomain
    free
    runtime.cookies.scope-too-broad
  • Session cookie valid for over a year
    free
    runtime.cookies.session-lifetime-excessive
  • CSP only reports, never blocks
    free
    runtime.headers.csp-report-only-only
  • CSP leaves base-uri and form-action open
    free
    runtime.headers.csp-missing-injection-guards
  • CORS response cacheable for the wrong site
    free
    runtime.headers.cors-vary-origin-missing
  • DNS name points at a host nobody owns
    free
    runtime.dns.dangling-cname
  • CAA record forbids the current certificate issuer
    free
    runtime.dns.caa-excludes-issuer
  • www and bare domain do not lead to the same site
    free
    runtime.dns.www-apex-inconsistent
  • Mail domain has no SPF record
    free
    runtime.email.spf-missing
  • SPF record is invalid or lets anyone send
    free
    runtime.email.spf-invalid
  • Mail domain has no DMARC policy
    free
    runtime.email.dmarc-missing
  • DMARC policy only monitors
    free
    runtime.email.dmarc-not-enforced
  • robots.txt blocks every crawler
    free
    runtime.seo.robots-blocks-everything
  • Home page is marked noindex
    free
    runtime.seo.page-marked-noindex
  • Canonical URL points somewhere wrong
    free
    runtime.seo.canonical-broken
  • Sitemap does not match the site
    free
    runtime.seo.sitemap-broken
  • Home page has no title or description
    free
    runtime.seo.title-or-description-missing
  • Structured data does not validate
    free
    runtime.seo.structured-data-invalid
  • Social preview image does not load
    free
    runtime.seo.social-preview-broken
  • Doctype, lang, charset or viewport missing
    free
    runtime.html.document-basics-missing
  • security.txt expired or has no contact
    free
    runtime.wellknown.security-txt-stale
  • Server answers TRACE
    free
    runtime.http.trace-enabled
  • Error page shows a stack trace or debugger
    free
    runtime.http.error-page-leaks-internals
  • Missing pages answer 200
    free
    runtime.http.soft-404
  • Missing pages redirect to the home page
    free
    runtime.http.missing-page-redirects-home
  • Redirect loop
    free
    runtime.http.redirect-loop
  • Unknown API route answered with HTML or the app shell
    free
    runtime.http.api-unknown-route-misbehaves
  • Missing JavaScript files return an HTML page
    free
    runtime.http.missing-asset-returns-html
  • Server errors are cacheable
    free
    runtime.http.error-response-cached
  • Home page links to missing pages
    free
    runtime.http.broken-internal-links
  • HTML served uncompressed
    free
    runtime.http.html-not-compressed
  • Page with a session cookie is publicly cacheable
    free
    runtime.caching.personalized-response-cacheable
  • Payment provider wired in test mode
    free
    runtime.environment.test-mode-payment-configuration
  • Placeholder or default page content
    free
    runtime.environment.placeholder-content
Domains

Not everything we find is a vulnerability.

A finding says which domain it belongs to, so a slow route and a leaked key are never filed under the same word.

  • Security

    Something that lets someone do what they should not be able to do.

  • Privacy

    Personal data going somewhere it was not meant to go.

  • Performance

    Work your application does that it does not need to do.

  • Cost abuse

    A way for a stranger to spend your money: no rate limit, an open API.

  • Reliability

    Things that are simply broken in production, in front of users.

  • Code quality

    How easy the code is to change: duplication, size, calls, structure. Kept apart from security, never counted as an issue.

Credential patterns

Sixteen keys we can name.

The secret scanner reads your JavaScript bundles, every push, commit messages and bounded git history. What it can identify, it names - and masks before storing it.

OpenAI secret keyAnthropic secret keyStripe secret keyStripe test secret keyStripe publishable keyAWS access key idGitHub tokenSlack tokenSendGrid keyResend keyTwilio keyGoogle API keySupabase service role JWTPrivate key blockDatabase URL

Anything shaped like a credential but unnamed is still reported, at a lower confidence, with the reason stated: we can see the name says secret, we cannot see whether the value is live.

Pipeline

Which stage runs which rules

A rule belongs to a stage. When a stage is skipped - a site that will not load, a repository that is not connected - the report says which rules therefore did not run.

  1. 01
    Reaching the site
    DISCOVERY
  2. 02
    Checking HTTPS
    TLS
  3. 03
    Detecting the stack
    TECHNOLOGY_DETECTION
  4. 04
    Inspecting security headers
    HEADERS
  5. 05
    Checking cookies
    COOKIES
  6. 06
    Reading DNS and mail records
    DNS
  7. 07
    Reading the page head and structure
    HTML_DOCUMENT
  8. 08
    Reading robots.txt, sitemaps and security.txt
    WELL_KNOWN
  9. 09
    Checking methods and compression
    HTTP_BEHAVIOR
  10. 10
    Testing how missing pages are answered
    ERROR_PAGES
  11. 11
    Testing cross-origin rules
    CORS
  12. 12
    Scanning JavaScript for secrets
    JAVASCRIPT
  13. 13
    Probing exposed files
    PUBLIC_FILES
  14. 14
    Watching the site in a real browser
    BROWSER_RUNTIME
  15. 15
    Measuring the load
    PERFORMANCE
  16. 16
    Matching advisories
    ADVISORIES
  17. 17
    Classifying the change
    CHANGE_CLASSIFICATION
  18. 18
    Reading the diff for secrets
    SOURCE_SECRETS
  19. 19
    Resolving lockfiles
    DEPENDENCIES
  20. 20
    Tracking input through the code
    SOURCE_ANALYSIS
  21. 21
    Walking git history
    SOURCE_HISTORY
  22. 22
    Reading source no rule covers
    SOURCE_AI_REVIEW
  23. 23
    Correlating findings
    CORRELATION
  24. 24
    Scoring risk
    RISK_SCORING
  25. 25
    Preparing your report
    REPORT

Pick a rule. Then check it.

Run the free scan and compare what comes back against this page. Every finding names the rule that raised it.

Scan my app Create a free account