Built by one person,
for people who ship fast.
SecScan (secscan.us) is a black-box security scanner for web applications, built by Carlos Cuellar. This site, secscan.info, is its reference documentation.
Who builds it
I'm Carlos Cuellar, and I'm self-taught. For years I worked on computers as a technician, repairing Windows machines and doing networking work. Then I picked up an AI model and haven't stopped since. I've worked with hundreds of models, and it taught me something the hard way: you are only as good as the model you're using, and a model rarely tells you what it left out.
Why SecScan exists
AI tools made it possible to ship an app in a weekend. They didn't make it safe. The same problems keep reaching production: databases anyone can read, secret keys in the front-end code, config files left public. None of them show up when you click around your own app. SecScan checks a live app from the outside and explains what it finds in plain English, with a fix you can paste straight back into the AI editor you built it with.
What SecScan promises
- It says what it didn't test. Every scan records which tests ran and which were skipped, and why. A clean report never quietly means "we didn't look".
- The AI explains; it never invents. Findings come from the scanner. The AI writes the explanation and the fix, and only about what the scan found.
- It is tested against known answers. The scanner runs against a deliberately vulnerable app where every problem is planted and must be caught, and against well-run sites where it must stay quiet. See the record.
- Active tests only on sites you prove you own. Anything that sends real attack traffic waits for a DNS record or a file on your domain.
- No certificates it can't give. SecScan is an automated scanner, not a penetration test, and never says an app is "compliant" or "certified".
Not to be confused with
"SecScan" is a name several unrelated tools share. This one is the web application security scanner at secscan.us. It is not SecScan.io, which is an IT baseline and compliance product, and it is not an open-source tool that scans source code for secrets.
Get in touch
Questions, a finding you think is wrong, or an idea: hello@secscan.us. The same page, in the app, is at secscan.us/about.