Priced for one app, then for all of them.

No. The free scan reads only what an anonymous visitor can reach: TLS, headers, cookies, cross-origin rules, public JavaScript, markup, exposed paths, the DNS and mail records of the domain, robots.txt and sitemaps, how the site answers a page that does not exist, and everything a real browser sees on your page - the requests it makes, what leaves for third parties, alt text and labels, and how fast it actually loads. Connecting GitHub adds the source rules, dependency advisories and infrastructure checks, but the runtime half works on a URL alone.

Ten areas from one URL: security, privacy, SEO and indexing, AI crawler policy, performance, accessibility, domain and DNS, technology, app health and cost. Concretely: SPF, DMARC and the CNAME chain; whether the home page is indexable and where its canonical points; which AI crawlers robots.txt lets in; whether a missing page answers 404, 200 or a redirect to the home page, and whether the error page leaks a stack trace; alt text, labels and unnamed buttons; which third parties load before anyone consents; what the site keeps in localStorage. The report opens with how many checks ran and how many look good.

Yes, and not only for findings. Beside every fact the scan saw - a crawler with no rule in robots.txt, a DMARC policy still on p=none, a form control with no label, a 404 page that answers 200 - there is what it means, what to change, and a snippet to paste: the robots.txt group, the DNS record, the meta tag, the nginx location. This is written by the rule, costs nothing, and needs no model.

The free scan loads the home page in a real browser and records everything it does, then visits the not-found page to see what that loads. On paid plans the browser crawls up to twenty pages of the site and reads every one of them: title, description, canonical, heading outline, alt text, labels. Accessibility and SEO findings are then one finding per kind for the whole site, with the affected pages listed, rather than one per page.

No. An optional standard that is absent is recorded and explained, with the snippet to add it if you want it, and it is never counted as an issue. The same goes for a missing Open Graph image, a missing CAA record or a page without structured data. A scan that finds nothing to fix says so, and that is a result, not an empty page.

No. Scans read. Nothing is written, nobody is logged in, and the access-control probe replays a request the browser already made using the same public key your own page ships - it proves data is world-readable without touching it. The 404 analysis asks for a few paths that cannot exist and sends one HEAD to each link on your home page; it never runs a wordlist and never sends a body.

It is masked before it is stored. Evidence keeps enough to identify which key it is and where it lives; the value itself is never written to our database, never sent to a model, and never shown back in full.

No. Detection is deterministic and repeatable - the same input produces the same finding, with the rule id printed on it. AI is used after that, and only when you ask: to explain a finding in your application terms, to judge authorization, and to write a fix. Every AI task is budgeted before it runs.

Runtime and source findings for the same problem are correlated into one finding. The code finding is canonical and the runtime observation is attached as live proof, so you fix a line rather than close two tickets.

Each finding on the pull request is marked NEW or UNCHANGED against the base branch, so a review is about what this change introduced rather than about the backlog it inherited. A protection removed in the diff is raised as a security regression.

The unit AI work is priced in. A plan includes credits per usage window and each AI task has a fixed credit cost. Scanning your live site is free and unlimited on paid plans; the Free plan gets 5 a month at 1 credit each. Top-ups are available and nothing spends a credit without you starting it.

It is reported as partial, with the steps that completed, the steps that failed and the steps that were skipped. A partial scan is never presented as a clean result.

Yes, from the billing screen, and the plan stays active until the end of the period you paid for. After that the organization drops to Free, which does not expire: nothing is deleted and the runtime half of the product keeps working.