A security product has to go first.
You are about to point a scanner at your production app and hand it your repository. That deserves a straight account of what happens next, without a trust-badge collage standing in for one.
Every probe is a read an anonymous visitor could perform. Nothing is modified, nothing is submitted, nobody is logged in.
A credential is identified and masked before it is stored. The full value never reaches our database and never reaches a model.
TOTP with recovery codes, enforced at the login challenge, for every account that turns it on.
Owner, admin, member and viewer, with invitations, email verification and per-organization isolation on every query.
Every sensitive action - invites, role changes, dismissals, billing, exports - is written down and readable by owners and admins.
The App reads the repositories you connect. Source is analyzed and discarded; what we keep is findings, facts and file paths.
Nothing you connect is used to train a model. AI runs on the task in front of it and nothing is retained for anyone else.
Coverage is recorded per scan. A scan that could not finish says so rather than reading as a clean bill of health.
Enough to be useful.
- Findings
What a rule raised, where, and the masked evidence behind it.
- Facts
What we learned about the application, with confidence and provenance.
- File paths and line references
Enough to take you to the problem in your editor.
- Short snippets
A few lines of context around a finding, with secrets masked out.
Nothing beyond that.
- Your repository
Source is fetched for analysis and discarded afterwards. We are not a mirror.
- Full credential values
A secret is masked at detection. The full value is never written down.
- Your users’ data
A probe proves data is readable; it does not collect what it reads.
- Training data
Nothing you connect is used to train a model, ours or anyone else’s.
The one active check, and its rules.
Most of a scan is passive. One check is not: to prove that a data API answers anyone, somebody has to ask it. Here is exactly how that is bounded.
- Only GET-shaped reads an anonymous visitor could perform.
- Only against the origin you submitted, and only after it is validated.
- Only with the public key your own page already ships to browsers.
- A bounded number of requests, rate-limited, with a scanner user agent.
- Nothing is written, nothing is submitted, no account is used.
- Results record that data was readable - not the data itself.
Controls you can actually use.
- Two-factor authentication
TOTP with recovery codes, enforced at the login challenge.
- Verified email
Address ownership is proven before an account can be used.
- Roles
Owner, admin, member and viewer, with invitations that expire.
- Sessions
Refresh rotation, and scan streams bound to a single scan rather than your session.
- Audit log
Append-only, readable by owners and admins, exportable and streamable.
- Deletion
Ask and an organization, its sites, scans, findings and facts go with it.
Found something here?
We would rather hear it from you than read about it later. Email security@appscan.sh with what you found and how to reproduce it. We will confirm receipt, keep you updated while we fix it, and credit you if you want the credit.
- · Run denial-of-service tests against the platform.
- · Access, modify or delete data belonging to another customer.
- · Use social engineering against our team or our vendors.
Read it, then test it.
Everything on this page is checkable against a scan you can run right now, without an account.