Your first scan.
A report you can act on.

1. Run your first scan

1. Log in to VAS. If you bought on AppSumo, activate your license on the account you want to use.
2. Open New scan. Choose a saved website or enter your published app's address, such as https://yourapp.com. Use a website you own or have permission to test. The website must be reachable from the internet.
3. Leave the optional fields empty for your first scan. You can add important paths, such as /dashboard, to prioritize pages. If you need checks behind login, see the test login explanation below.
4. Select Run Scan. VAS queues the scan, visits reachable pages, runs checks, and builds a report. You can return to Scans to reopen it. A queued or running scan is still working; wait for completion before interpreting the results.
5. Read coverage first, then the most serious findings. Open a finding to see what VAS observed and the suggested fix. You can work through one issue at a time.

Which URL do I enter? Use the app your customers visit. A builder's project editor, localhost address, GitHub repository, or bare Supabase project URL is a different target. A live-app scan observes the deployed website; it does not automatically read your private source code.

2. Find your way around

Scans

Your scan history. Open an entry to read that scan's report.

New scan

Start a scan of a published website.

Websites & monitoring

Manage saved websites and the automated scanning options available to your account. Check the schedule and allowance shown here before enabling monitoring.

Billing

Check the plan active on your account and its included allowances.

Account

Manage your account settings.

On a smaller screen, open the navigation menu to find these pages. Extra items, such as Developer or Repositories, depend on your account's access. Source-code scanning is a separate workflow with its own access and limits.

3. Read your report

A finding is something VAS observed that deserves review. It is not evidence that someone has hacked your app. Read the description, evidence, and coverage together before deciding what to change.

Start with coverage: what did VAS actually check?

The summary separates completed checks from checks that were limited, skipped, or unfinished. A skipped check is not a pass. Coverage limitations explain what the scan could not assess, such as pages behind login or a website that did not load.

If the report says the application was not assessed, or only a login or placeholder page was reached, resolve that limitation before treating the results as an assessment of the full app. Sample coverage describes the pages and resources observed during this scan, not every page your app contains.

Use severity to choose what to review first

Critical

Review first. The finding indicates a potentially serious exposure, such as access to sensitive data or a secret key.

High

Review next. The issue could create a significant security risk and needs prompt attention.

Medium

Plan a fix after the most serious issues. The impact depends on how your app is built and used.

Low

A smaller weakness or hardening improvement. Review it in the context of your app.

Info

An observation to help you understand the app. It does not, by itself, mean there is a vulnerability.

Severity and confidence answer different questions. Severity describes the potential impact. Detection confidence describes how certain the scanner is about its observation. A severe finding with lower confidence needs investigation; it should not be assumed proven or ignored.

Open a finding to understand it

• Description: what VAS detected and why it may matter.
• URL: the page or resource associated with the finding, when available.
• Evidence: the response or observation behind the finding. You do not need to understand every technical detail to ask for help.
• Remediation: the suggested steps to address the issue. This is the part to review with your developer or AI coding tool.
• Confidence: the scanner's certainty about the detection. Some findings also note that the resource may be intentionally public.

Some related findings are grouped together. Expand the group, then inspect each item. Category filters help you separate security findings from other issues.

Understand the score and the other categories

The security score or letter grade summarizes the security findings detected in that scan. More serious findings affect the score more heavily. It is not a percentage chance of being hacked or a security certification. Review a Critical or High finding even if the overall score looks reassuring.

Site-quality findings cover areas such as SEO, performance, and accessibility. Email checks cover domain email configuration. A site-quality issue does not automatically mean someone can access your data. A compliance-related observation is not a legal determination or certification.

No issues found means none were detected in the completed checks and reachable sample. It does not guarantee the whole app is secure. Positive findings or security strengths describe protections observed during the scan.

Want to see the format before scanning? View the fictional sample report. Its example findings are not results for your app.

4. Fix an issue and scan again

1. Choose one finding. Start with a Critical or High security issue. Read its evidence and suggested remediation.
2. Export the fix instructions. In an unlocked report with findings, open AI Fixes & Export, then select Download AI fix instructions. Use PDF report if you want a document to review or share privately.
3. Review the fix in your project. Give the relevant finding and remediation to your developer or AI coding tool. VAS does not automatically change your app when it runs a website scan.
4. Test and publish the change. Check that the intended users can still use the feature. The website scanner can only observe the fix once it is deployed to the URL being scanned.
5. Run a new scan. Select Rescan when available, or start a new scan of the same website. Use comparable paths and test-login settings. Rechecks use your scan allowance.

A finding marked no longer reported was absent from the later scan. That can happen because a fix worked, or because the page or scan coverage changed. Check the coverage and test the original behavior before considering it resolved.

Suppress records that you consider a finding a false positive, accept the risk, or will not fix it. Suppression does not fix the underlying issue. If you are unsure, request a review first.

5. Bought VAS on AppSumo?

Open your AppSumo purchase and use its activation flow. Log in to the VAS account you want to use. If you were given a license code, open the AppSumo activation page and enter it there.

After activation, check Billing and New scan for your account's access and allowance. AppSumo tiers have their own terms; a monthly subscription's feature list does not necessarily describe your lifetime plan.

If you see a free-plan screen or locked report after activating, confirm you are using the same VAS account. If it still looks wrong, contact us with your account email and AppSumo tier so we can check the license before you purchase anything else.

6. Common questions