[sec]scan Run a scan →
Reports

A finding you can't act on
is just anxiety

Raw scanner output is a list of things that are wrong, written for someone who already knows what they mean. Every SecScan report goes through a second pass that rewrites it for the person who has to fix it — and generates a prompt aimed at the tool they built with.

See a real sample report →
Structure

What's in a report

Every finding carries its own evidence — the exact HTTP response, header value or decoded payload that triggered it — plus a CWE identifier, a WSTG reference, and a confidence score. On top of that sit five written sections.

  1. 01

    Overall risk

    One paragraph a non-specialist can take to a stakeholder.

  2. 02

    Top priorities

    What to fix first, ordered by consequence rather than by severity label.

  3. 03

    Quick wins

    Findings that clear in minutes — usually a header, a flag or a deleted file.

  4. 04

    Compliance notes

    Findings mapped to SOC 2, PCI DSS, ISO 27001, OWASP ASVS, NIST SP 800-53 and HIPAA Security Rule controls by CWE. Omitted when nothing maps.

  5. 05

    Agent fix prompt

    A paste-ready instruction written for the tool you actually build with.

The differentiator

Fix prompts written for your build tool

"Enable Row Level Security on that table" is correct and useless if you have never opened a SQL console. SecScan detects which tool the application was built with — from technology fingerprints and from the hostname — then writes the remediation as an instruction you can paste straight back into it.

Lovable

A lovable fingerprint in the stack, or a hostname ending .lovable.app / .gptengineer.app

Bolt.new

A bolt.new fingerprint, or a hostname ending .bolt.new / .stackblitz.io

Next.js

A Next.js fingerprint — the Cursor, Claude Code and Vercel workflow

WordPress

A WordPress fingerprint — remediation via plugins and admin, not code

Supabase

Supabase with no major framework alongside it — raw backend instructions

Shopify, Wix, Squarespace, Webflow

A hosted site builder — each finding is split into what you can change in the platform and what only the platform controls

Firebase

Firebase with no framework alongside it — security rules, console changes and firebase.json headers

Vercel

Served by Vercel with no framework detected — headers in vercel.json

Netlify

Served by Netlify with no framework detected — headers in _headers or netlify.toml

Generic

Nothing specific matched — plain, framework-neutral remediation

Detection runs most-specific-first: a hostname on .lovable.app wins over a generic React fingerprint. Supabase, Firebase, Vercel and Netlify route to their own instructions only when no major framework is detected alongside them, because the framework then decides how the code is edited.

AI analysis availability

The written analysis in every report runs on a third-party AI provider. If no key is configured for it, the scan still completes and the report still renders. Every external dependency degrades gracefully: the AI pass, the email sender and the payment layer each check for their key at startup and log a warning if absent rather than failing the run.

You can turn the written analysis off in Settings, under Privacy. The provider is sent the findings for each scan (names, descriptions and evidence, with anything shaped like a password or key removed) and never the credentials used for a credentialed scan. With the setting off, none of that is sent. The scan and every finding are unchanged; the report simply has no written summary or fix prompts, and says why.

Sharing a report

Reports are private to your account. To show one to someone — a client, a contractor, the person who actually owns the server — you generate a tokenised share link with an expiry of 7 days, 30 days, or never. Links can be revoked at any time, and revocation is immediate rather than a flag the viewer's cache might ignore.

A share link exposes the findings, which is to say a map of your application's weak points. Prefer a 7-day expiry over "never" unless the report is genuinely meant to be permanent, and revoke it when the conversation ends.

Comparing scans

Rescanning the same target produces a comparison rather than an isolated snapshot: what was fixed, what is new, and whether the grade moved. With continuous monitoring on, that comparison runs on a schedule and a regression — a finding you had cleared coming back — raises an alert on its own.

Each report opens with a "Since your last scan" card listing what was fixed, what is new and what is unchanged. A finding counts as fixed only if the test that raised it ran again and came back clear; if that test did not run, it is shown as not re-checked rather than fixed.

Checking a fix

Under each finding's recommended fix, "Check it" re-scans the site and judges the result against that one finding. The answer is one of fixed, still present, or not re-checked when the test could not run. It does not use up one of your scans.

Confidence scores

Findings carry a confidence value because not all evidence is equally strong. An out-of-band SSRF callback carrying a token that appears nowhere else is confidence 95 — there is effectively no other explanation. A behaviourally confirmed injection sits at 90. A missing header is simply observed. Where a check cannot reach certainty, the report says so instead of rounding up.

Compliance mapping

Every finding also carries the framework controls it's evidence for — SOC 2, PCI DSS 4.0.1, ISO 27001:2022 Annex A, OWASP ASVS 4.0.3, NIST SP 800-53 Rev. 5 and the HIPAA Security Rule technical safeguards — keyed off the finding's CWE, and the report includes a per-framework summary. A reviewer who asks "show me you test for injection" gets findings mapped to PCI DSS 6.2.4 and ASVS V5.3.3: real, checkable work instead of a claim.

What this is not: a compliance assessment, an audit, or an attestation. A scan sees the HTTP surface of a running application at one moment; SOC 2 and ISO 27001 are overwhelmingly about policy, personnel and process that no scan can observe. There is no percentage or pass rate anywhere in the mapping — a framework nothing maps to is left out of the report rather than shown as passing. Only a licensed CPA firm issues a SOC 2 report, only a QSA validates PCI DSS, and only an accredited body certifies ISO 27001.

Read one against your own site

Every account gets 3 free scans every month. Takes a minute to sign up and verify your email.

Generate a report →