AppScan
Product · Application Brain

It remembers your app between scans.

A scanner that starts from zero every time can only ever tell you generic things. AppScan keeps what it learned, re-verifies it as the code changes, and uses it to write findings in your application's own terms.

Scan my app How facts are re-verified
01Facts

15 domains of what we know.

Each fact records which scan established it, what evidence it rests on, and how sure we are. You can open the list and read the whole picture - there is no hidden model state that only the product can see.

ARCHITECTURE
How the parts are arranged and what talks to what.
TECH_STACK
Frameworks, runtimes, hosting, the CDN in front of it.
ROUTES
Endpoints from source, endpoints seen at runtime, and the difference.
AUTHENTICATION
How a session begins and what issues it.
AUTHORIZATION
Which routes are guarded, and by what.
TENANCY
How rows are separated between customers.
DATA_MODEL
What is stored, and which of it is personal.
DEPENDENCIES
Exact versions, direct and transitive, from lockfiles.
EXTERNAL_SERVICES
Third parties the app depends on to work.
SECURITY_CONTROLS
The protections that are actually in place.
CORS
Which origins may call the API, and with what.
RATE_LIMITS
Where limits exist, and where none were observed.
INFRASTRUCTURE
How the app is built, shipped and exposed.
CI_CD
The pipeline that builds and deploys it, recognized from its files.
PERFORMANCE
Per-route baselines to measure regressions against.
everything we know about this app15 fact domains
  • TECH_STACK
    Next.js 15 on Vercel, Prisma against Postgres, Stripe for payments.
  • ROUTES
    38 endpoints from source, 12 of them mutating, 4 seen at runtime only.
  • AUTHENTICATION
    Session cookies issued by the app; no third-party identity provider.
  • AUTHORIZATION
    requireRole guards 9 of 12 mutating routes.
  • TENANCY
    Rows are scoped by organizationId; two lookups are not.
  • DATA_MODEL
    Orders, customers and refunds hold personal data.
  • EXTERNAL_SERVICES
    Stripe, Resend, Supabase storage, Sentry.
  • SECURITY_CONTROLS
    CSP present, HSTS present, webhook signatures verified.
  • RATE_LIMITS
    No rate limit observed on the public search route.
  • INFRASTRUCTURE
    Dockerfile runs as root; database port published in Compose.
02Confidence

A fact says how sure it is.

Security tools lose trust by stating guesses as facts. Every fact here carries its state on its face.

CONFIRMED

Proven by evidence a rule collected, from source or from runtime.

LIKELY

Strongly indicated but not proven. Used for ranking, never for a claim.

VERIFYING

A check is in flight; the fact is being re-established right now.

UNKNOWN

We do not know, and the product says so instead of inventing an answer.

INVALIDATED

It used to be true. A change made it false, and the history is kept.

03Why it matters

Memory is what makes the next scan better.

  • Findings in your terms

    “Your Stripe key” rather than “a credential”. The brain knows which services you use and what they can do.

  • Cheaper AI

    A summary of established facts is a far smaller prompt than a repository, which is why a deep review fits inside a fixed budget.

  • Sharper priorities

    A route that holds personal data outranks one that does not. Ranking needs to know which is which.

  • Regressions worth the name

    Invariants and baselines only exist because something remembered how things were before.

Give it one app and let it learn.

The first scan establishes the facts. Every scan after that is measured against them.

Scan my app Create a free account