Adding a site

A site is one application. Adding one takes a URL; everything else - repositories, policy, monitoring - hangs off it.

Add a site from Sites → Add site. You give it an address and, optionally, run the first scan straight away. From then on the site is the thing you open when you want to know how that application is doing.

What a site holds

Overview: Headline, severity spread, fix-first list, controls, application facts and recent activity.
Issues: Every finding for this site, filterable by severity, status, domain, priority and confidence.
Scans: History with coverage and duration, plus the scan policy for the site.
Reports: Every report produced, and what changed since the previous one.
Repositories: Connected repositories, inventory state, change sets, pull requests and commits.
Application: Everything the Application Brain knows, by domain, with confidence and provenance.
Invariants: The rules your code establishes: holding, broken or not verifiable.
API: Endpoints found in source with their guard state, and routes seen at runtime.
Performance: Per-route baselines, client-navigation recordings and performance issues.
Dependencies: Packages from lockfiles, direct and transitive, with the vulnerable count.

Use the address people actually visit

Scan the canonical hostname. Scanning a redirect source, a preview deployment or a CDN edge you do not control produces findings about someone else’s configuration.

Questions

How many sites can I have?

One on Free and Pro, three on Studio, ten on Agency and twenty-five on Team.

Should staging be its own site?

Yes, if you want it watched. It counts against your site limit, so on a one-site plan most people point AppScan at production and use a manual scan when they want to check staging.

Can I scan something that is not on the public internet?

The runtime half needs to reach the address. Anything behind a VPN or an allowlist will report its steps as skipped. The source, dependency and infrastructure rules still work, because those come from the repository.

Something here wrong, missing or out of date? Tell us and we will fix the page.