The scan pipeline
Nineteen deterministic stages, each producing structured evidence. Not one model reading everything at once.
A scan is a sequence of stages. Each stage does one thing, writes down what it saw, and hands on. That is what makes a finding reproducible, a partial scan honest, and the next scan cheaper than the last.
| # | Stage | What it does |
|---|---|---|
| 01 | DISCOVERY | Reaches the address, follows redirects, waits out interstitials and holding pages. |
| 02 | TECHNOLOGY_DETECTION | Works out the stack from headers, markup and asset fingerprints. |
| 03 | TLS | HTTPS availability, certificate validity, expiry and the redirect from HTTP. |
| 04 | HEADERS | Security headers, judged on quality rather than presence. |
| 05 | COOKIES | Session cookie flags: Secure, HttpOnly, SameSite. |
| 06 | CORS | Cross-origin rules, especially origin reflection with credentials. |
| 07 | JAVASCRIPT | Public bundles read for credentials and published source maps. |
| 08 | PUBLIC_FILES | Exposed .env, .git, backups, dumps and developer tooling. |
| 09 | BROWSER_RUNTIME | A real Chromium walks routes and records every request. |
| 10 | PERFORMANCE | Per-route load, DOM-ready and time-to-first-byte baselines. |
| 11 | CHANGE_CLASSIFICATION | What a push actually touched, and how seriously to read it. |
| 12 | SOURCE_SECRETS | Credentials in the diff, in files and in commit messages. |
| 13 | SOURCE_ANALYSIS | Taint analysis: request input tracked to the sink it reaches. |
| 14 | SOURCE_HISTORY | A bounded walk of git history for credentials that were deleted but not rotated. |
| 15 | DEPENDENCIES | Exact versions resolved from lockfiles, direct and transitive. |
| 16 | ADVISORIES | Those versions matched against public advisories. |
| 17 | CORRELATION | Runtime observations joined to the source that caused them. |
| 18 | RISK_SCORING | Severity, confidence and context turned into an order to work in. |
| 19 | REPORT | The report assembled, with coverage recorded. |
Why stages rather than one prompt
- The same input produces the same finding, every time, with the rule id printed on it.
- A stage that cannot run is recorded as skipped instead of silently producing nothing.
- Each stage is separately budgeted, so one slow target cannot hold up a queue.
- Evidence accumulates, which is what makes correlation and the Application Brain possible.
Questions
Do all nineteen stages run on every scan?
No. Which stages run depends on the kind of scan and on what is connected. A free runtime scan runs the live-site, browser and performance stages; a push runs the source stages; the report and scoring stages always run.
Does AI run during a scan?
No. Detection is entirely deterministic. AI tasks happen afterwards and only when a person asks for one.
Something here wrong, missing or out of date? Tell us and we will fix the page.