Documentation

An application security platform for people who ship faster than they can review: deterministic detection, one finding per problem, AI only where you ask for it.

A URL and an email start a bounded runtime scan. Progress streams live; the report arrives by email and stays at a private link.

What the headline, the fix-first list, coverage and the finding detail each tell you, and the order to read them in.

Everything belongs to an organization: sites, scans, findings, credits and people. Here is how that fits together.

A site is one application. Adding one takes a URL; everything else - repositories, policy, monitoring - hangs off it.

Installing the GitHub App turns on the source, dependency and infrastructure rules, pull request checks and Fix with AI.

Nineteen deterministic stages, each producing structured evidence. Not one model reading everything at once.

Free runtime, manual runtime, source inventory, source change, pull request, history and advisory review - what triggers each.

Every scan records which steps completed, failed and were skipped. A scan that could not finish says so.

A headless Chromium walks your routes cold and through client navigation, and records every request the page makes.

How many scans can run at once, how long to wait between manual rescans, and how work is prioritized.

Progress streams over server-sent events, in the app and on the free-scan page.

Five questions, a rule id, a location and masked evidence - written deterministically by the rule before any model is asked anything.

Three separate numbers, used together. Severity is impact, confidence is certainty, and the domain says what kind of problem it is.

Open, confirmed, fixing, resolved, verified - and what moves a finding between them.

Two ways to close something you are not going to fix, both recorded, both permanent until you reopen them.

A runtime observation and the source that caused it are joined. The code finding is canonical; the live observation is attached as proof.

249 rules across four groups, each with an id that is stamped onto every finding it raises - 110 of them on the free scan.

Rapid pushes are coalesced into one change set, classified by what they touched, and scanned once.

Findings on a branch are compared with its base: NEW is what this change introduced, UNCHANGED is what it inherited.

The rules your own code already follows, derived once and re-checked on every commit.

Exact versions from your lockfiles, direct and transitive, matched against public advisories and re-checked daily.

Sixteen named credential patterns across bundles, diffs, commit messages and a bounded walk of git history.

Dockerfile, Compose, nginx, Kubernetes, Terraform and GitHub Actions - the files that decide how your app is really exposed.

Seven tasks, each with a fixed price in credits and a per-call money cap.

A fix written against your file and opened as a draft pull request on a branch of its own.

Every task is estimated, reserved, capped and routed by difficulty - and refunded when it fails.

The whole application judged at once on the premium tier, paid for once and kept afterwards.

A report is one application at one moment, with coverage, findings and what changed since last time.

CSV, JSON and PDF for reports and issue lists, plus scheduled audit-log exports.

Instant for what cannot wait, grouped and cooled down so one bad deploy is one message; a digest for the rest.

One incoming webhook per organization, carrying the same grouped alerts.

The organization sets the baseline; each person narrows it for themselves.

Everything the app does is available over the API, with the same permissions and the same tenancy rules.

Registering, signing in, refreshing, two-factor, verification, passwords and personal notification preferences.

The organization, its members and invitations, notification settings and the AI usage summary.

Sites, manual scans, domain verification, monitoring mode, the profile and the overview.

The public scan from the landing page: submit, watch, and read the report by token.

Findings with their five answers, status changes, reports and every export format.

Installing the App, connecting repositories, and reading commits, change sets, dependencies and pull requests.

Explanations, fixes, the draft pull request, deep scans and what each task costs.

The plan, the subscription, checkout, the portal, the trial, invoices, and the public pricing endpoint.

The append-only audit trail, its sinks and schedules, and the scan event streams.

Owner, admin, member and viewer, with invitations that expire and an audit trail.

TOTP with recovery codes, enforced at the login challenge.

Verification, password changes, resets and how sessions are held.

Append-only, readable by owners and admins, exportable and streamable.

Free, Pro at $29, Studio at $49, Agency at $99 and Team by arrangement - with the limits the product actually enforces.

The unit AI work and manual scans are priced in. Plans include credits per window; top-ups never expire.

Fourteen days of Pro, no card, once per organization.

What happens when a card fails, how cancelling works, and how refunds affect credits.

Reads only, nothing written, nobody logged in - and one bounded active probe, with its rules written down.

Findings, facts, paths and masked evidence. Not your source, not your secrets, not your users’ data.

Email security@appscan.sh. What to include, what we will do, and what not to do.

Why discovery fails, and what to check in order.

Sometimes that is real. Here is how to tell.

Usually the repository is not connected, the language is not analyzed, or inventory has not finished.

Missing checks, a repository that will not appear, and installations that vanish.

How to see exactly what spent what, and what can and cannot spend on its own.

Prometheus scrape endpoints on the API and the worker, and audit streaming for teams that keep a SIEM.

Every term used on this site, in one place.