Straight answers.

No. The free scan reads only what an anonymous visitor can reach: TLS, headers, cookies, cross-origin rules, public JavaScript, markup, exposed paths, the DNS and mail records of the domain, robots.txt and sitemaps, how the site answers a page that does not exist, and everything a real browser sees on your page - the requests it makes, what leaves for third parties, alt text and labels, and how fast it actually loads. Connecting GitHub adds the source rules, dependency advisories and infrastructure checks, but the runtime half works on a URL alone.

Ten areas from one URL: security, privacy, SEO and indexing, AI crawler policy, performance, accessibility, domain and DNS, technology, app health and cost. Concretely: SPF, DMARC and the CNAME chain; whether the home page is indexable and where its canonical points; which AI crawlers robots.txt lets in; whether a missing page answers 404, 200 or a redirect to the home page, and whether the error page leaks a stack trace; alt text, labels and unnamed buttons; which third parties load before anyone consents; what the site keeps in localStorage. The report opens with how many checks ran and how many look good.

Yes, and not only for findings. Beside every fact the scan saw - a crawler with no rule in robots.txt, a DMARC policy still on p=none, a form control with no label, a 404 page that answers 200 - there is what it means, what to change, and a snippet to paste: the robots.txt group, the DNS record, the meta tag, the nginx location. This is written by the rule, costs nothing, and needs no model.

The free scan loads the home page in a real browser and records everything it does, then visits the not-found page to see what that loads. On paid plans the browser crawls up to twenty pages of the site and reads every one of them: title, description, canonical, heading outline, alt text, labels. Accessibility and SEO findings are then one finding per kind for the whole site, with the affected pages listed, rather than one per page.

No. An optional standard that is absent is recorded and explained, with the snippet to add it if you want it, and it is never counted as an issue. The same goes for a missing Open Graph image, a missing CAA record or a page without structured data. A scan that finds nothing to fix says so, and that is a result, not an empty page.

No. Scans read. Nothing is written, nobody is logged in, and the access-control probe replays a request the browser already made using the same public key your own page ships - it proves data is world-readable without touching it. The 404 analysis asks for a few paths that cannot exist and sends one HEAD to each link on your home page; it never runs a wordlist and never sends a body.

It is masked before it is stored. Evidence keeps enough to identify which key it is and where it lives; the value itself is never written to our database, never sent to a model, and never shown back in full.

No. Detection is deterministic and repeatable - the same input produces the same finding, with the rule id printed on it. AI is used after that, and only when you ask: to explain a finding in your application terms, to judge authorization, and to write a fix. Every AI task is budgeted before it runs.

Runtime and source findings for the same problem are correlated into one finding. The code finding is canonical and the runtime observation is attached as live proof, so you fix a line rather than close two tickets.

Each finding on the pull request is marked NEW or UNCHANGED against the base branch, so a review is about what this change introduced rather than about the backlog it inherited. A protection removed in the diff is raised as a security regression.

The unit AI work is priced in. A plan includes credits per usage window and each AI task has a fixed credit cost. Scanning your live site is free and unlimited on paid plans; the Free plan gets five a month at one credit each. Top-ups are available and nothing spends a credit without you starting it.

It is reported as partial, with the steps that completed, the steps that failed and the steps that were skipped. A partial scan is never presented as a clean result.

Yes, from the billing screen, and the plan stays active until the end of the period you paid for. After that the organization drops to Free, which does not expire: nothing is deleted and the runtime half of the product keeps working.

Source analysis today is TypeScript and JavaScript, including the framework routing conventions around them. Everything that does not depend on parsing your language - the live-site rules, the browser pass, dependency advisories from lockfiles, Docker, Compose, nginx, Kubernetes, Terraform and GitHub Actions - works whatever the application is written in.

The free pass is one page and a bounded browser recording. A full scan walks a limited number of routes with rate limiting and a scanner user agent. Every stage has a time budget, and the scanner backs off rather than pushing through a site that is struggling.

Yes, and for the first run it is often the better choice. Anything reachable over HTTPS with a public hostname can be scanned; basic-auth walls and IP allowlists will limit what the runtime half can see, and the report says so.

The whole runtime half of the product, for as long as you want it: the live-site rules, the real-browser pass and the access-control probe, on one site, with the report by email. Free is a plan rather than a trial - it has no end date. What a paid plan adds is the repository: source rules, dependency advisories, infrastructure checks, pull request verdicts and Fix with AI.

Not today. Accounts are email and password with TOTP two-factor and recovery codes, plus roles and invitations per organization. If SSO is a requirement for you, say so when you talk to us - it is on the list and demand decides the order.

A small team building the security review we wanted while shipping our own products fast. The whole thing is designed around one rule: never make a claim the product cannot show you the evidence for.