How a scan runs, from first target to continuous monitoring

No agents to install on the target, no intrusive testing. Four stages take you from zero visibility to an always-current view of your exposure.

Add a website or repository

Point it at a website URL for passive scanning, or a repository — a local path on the server, or a public GitHub repo cloned just for the scan. Website scans are read-only: no authentication testing, no intrusive probing.

https://app.example.comScan

The scan runs

Website scans check headers, CSP, cookies, TLS, DNS, and mixed content in seconds. Repository scans resolve dependencies across 8 package ecosystems via OSV.dev, and check for secrets, container misconfiguration, risky code patterns, and LLM-usage risk.

headersok

tlsok

dnsrunning

Findings are scored and correlated

Each finding gets a severity and confidence rating. Related findings — within the same scan, and across scans and assets — are correlated into attack paths, so you see how issues compound rather than a flat, unordered list.

highmediummediumlow

Monitoring keeps watching

Turn on monitoring for an asset and it re-scans on a schedule, tagging each finding new, persisting, fixed, or regressed against the previous run — with alerts routed to a webhook if something changes.

New→Persisting→Fixed

Scoring, in plain terms

Each scan produces an overall score and a per-category score, both 0–100. Higher severity findings with higher confidence weigh down the score more; the same math runs whether it's a single scan or a CI gate.

Watch it, step by step

Ten short walkthroughs of the real product — from your first scan to exporting your data. Every one is actual screen recording, silent with on-screen labels, and under a minute.

webcuris.com