AppScan
Product

Four things, done in order.

AppScan is not one model reading your repository. It is a pipeline: deterministic detection first, correlation second, continuous monitoring third, and AI last - where a person has asked for it and the budget has been checked.

Scan my app See all 249 rules
01Live scan

A URL is enough. Nineteen deterministic stages reach your app the way a visitor does, then walk it in a real browser and record every request it makes.

62 live-site rules52 real-browser rulesFree: 110 of them
Read more
02Code monitoring

Connect the GitHub App and every push is classified, every pull request gets a verdict against its base branch, and the invariants your code establishes are re-checked.

52 source rules38 infrastructure rulesNEW vs UNCHANGED verdicts
Read more
03Fix with AI

Ask, and the fix is written against your file and opened as a draft pull request. Every task is priced in credits before it runs.

16 credits to plan58 credits to patchNothing runs unasked
Read more
04Application Brain

Facts about your app survive between scans: stack, routes, guards, tenancy, data, rate limits - each with a confidence and a provenance.

15 fact domainsDerived invariantsPer-route baselines
Read more
Go deeper

Six capabilities, each on its own page.

Performance and the real browserWeb Vitals, waterfall, baselinesPull request checksNEW against UNCHANGED, per changeDependencies and advisoriesSeven ecosystems, exact versionsInfrastructure and CIDocker, Kubernetes, Terraform, ActionsSecurity invariantsThirteen truths, re-checked on every pushAlerts and reportsSlack, email, digests, exports
The pipeline

Every stage leaves evidence.

A stage does one thing and writes down what it saw. That is what makes a finding reproducible, a partial scan honest, and the next scan cheaper than the last - and it is why a rule can tell you how it will verify its own fix.

What each stage looks at
scan pipeline25 stages
  1. 01
    Reaching the site
    DISCOVERY
  2. 02
    Checking HTTPS
    TLS
  3. 03
    Detecting the stack
    TECHNOLOGY_DETECTION
  4. 04
    Inspecting security headers
    HEADERS
  5. 05
    Checking cookies
    COOKIES
  6. 06
    Reading DNS and mail records
    DNS
  7. 07
    Reading the page head and structure
    HTML_DOCUMENT
  8. 08
    Reading robots.txt, sitemaps and security.txt
    WELL_KNOWN
  9. 09
    Checking methods and compression
    HTTP_BEHAVIOR
  10. 10
    Testing how missing pages are answered
    ERROR_PAGES
  11. 11
    Testing cross-origin rules
    CORS
  12. 12
    Scanning JavaScript for secrets
    JAVASCRIPT
  13. 13
    Probing exposed files
    PUBLIC_FILES
  14. 14
    Watching the site in a real browser
    BROWSER_RUNTIME
  15. 15
    Measuring the load
    PERFORMANCE
  16. 16
    Matching advisories
    ADVISORIES
  17. 17
    Classifying the change
    CHANGE_CLASSIFICATION
  18. 18
    Reading the diff for secrets
    SOURCE_SECRETS
  19. 19
    Resolving lockfiles
    DEPENDENCIES
  20. 20
    Tracking input through the code
    SOURCE_ANALYSIS
  21. 21
    Walking git history
    SOURCE_HISTORY
  22. 22
    Reading source no rule covers
    SOURCE_AI_REVIEW
  23. 23
    Correlating findings
    CORRELATION
  24. 24
    Scoring risk
    RISK_SCORING
  25. 25
    Preparing your report
    REPORT
The result

One screen that answers “what now”.

Findings ranked by what they would cost you, each with the rule that raised it and the proof it was raised from.

appscan.sh/sites/checkout-app
Fix first
  • Criticalsource.secrets.credential-committed
    A Stripe secret key is committed to the repository
  • Criticalsource.injection.sql-built-from-input
    SQL is built from request input in findOrders
  • Highbrowser.network.data-readable-unauthenticated
    Orders API answers without a session
  • Mediumruntime.headers.csp-missing-or-unsafe
    Content-Security-Policy allows inline scripts
Scanrunning
  • ✓Reaching the site
  • ✓Checking HTTPS
  • ✓Detecting the stack
  • ✓Inspecting security headers
  • ✓Checking cookies
  • ✓Reading DNS and mail records
  • ·Reading the page head and structure
  • ·Reading robots.txt, sitemaps and security.txt
Pull request
2 new

9 unchanged findings inherited from main, not raised again.

Invariants
14 / 15

One broke in this change: tenant scope removed from a lookup.

Where it lands

It reaches you where you already are.

GitHub App

Install once, connect repositories to a site. Pushes are coalesced into change sets, pull requests get a check, and Fix with AI opens a draft branch.

Slack

A webhook per organization. Instant alerts are grouped and cooled down so one bad deploy does not become forty messages.

Email alerts and digests

Instant for what cannot wait, a digest for the rest, and per-user preferences on top of the organization setting.

Advisory feed

Lockfile versions are matched against public advisories, and affected apps are targeted for re-evaluation daily.

Exports

Any report or issue list as CSV, JSON or a PDF you can hand to a client without editing it first.

JSON API

Everything the app does is available over the API, with the same permissions and the same tenancy rules.

Stripe, PayPal and Paddle billing

Plans, top-ups, refunds and disputes behind signed idempotent webhooks and a normalized subscription state. Paddle sells as merchant of record, on our own checkout page.

Prometheus metrics

API and worker both expose scrape endpoints: HTTP, jobs, queues, GitHub, AI spend and scan outcomes.

See it on your own app.

The free scan takes a URL and an email. No account, no card, no install.

Scan my app Create a free account