Skip to preview options

Know what you are trying

Two ways to explore VAS. Different kinds of preview.

A URL preview checks your own deployed app. The code preview is a clearly labelled example report, not an upload or scan of your private repository.

Your app · first live-app scan

Free live-app preview

Your first live-app preview includes the available score, issue counts and one finding in detail when available. No card required.

  • Enter a deployed URL you own or have permission to test, create an account and review the scan terms before starting.
  • Review the observed issue counts, available finding and checks that could not run. An unreachable app may not have an assessable score.
  • No private repository connection is needed. This does not review all of your server-side source.
Start my live-app preview

Available to accounts that have not used their first live-app scan. No automatic subscription.

Fictional example · no source uploaded

Free sample code report

The free code report is a fictional example, not a scan of your repository. No connection, upload or account required.

  • See a source finding, example file location, suggested change and the assumptions you must verify.
  • Understand coverage notes before trusting a result. The example has no fabricated scan score or detected-issue total.
  • To scan your own source, choose an eligible plan and explicitly connect GitHub or upload a source ZIP.
View the fictional code report

No card, account, GitHub permission or private code required to view this example.

Check what shipped and what is in the code

Two complementary views: test a live-app URL, or review source from GitHub or a ZIP. Neither replaces the other.

Live app

Website URL

Check reachable pages, browser scripts and endpoints in a deployed app.

A URL scan does not read your private repository or prove every user-role permission.

View the live-app sample report

Source code

GitHub repository or source ZIP

Review supported source files, dependencies and configuration in a selected snapshot.

Source findings do not prove the same code is deployed or that an issue is exploitable in the live app.

View the fictional code sample report

Automated checks have coverage limits. No findings is not proof of security, and no longer detected is not a confirmed fix.