Product · Security Reports
A report you can hand to anyone: your team, your customer, your AI.
Every scan produces a structured report with full severity breakdown, evidence per finding, and remediation. Share a link, export Markdown for an agent, or download PDF for an audit.
- Full severity breakdown: Critical, High, Medium, Low, Info
- Evidence and reproduction steps for every finding
- Markdown export for Claude, Cursor, and Windsurf
- Shareable link or PDF for stakeholders
2
Critical
5
High
11
Medium
8
Low
- Exposed Supabase service_roleCRIT
- Missing CSP headerHIGH
- Mixed content on /pricingMED
How it works
3 steps to your first result.
- 1
Run a scan
Report is built automatically, nothing to configure.
- 2
Filter and triage
Sort by severity, scanner, or asset. Mark items as known/acknowledged.
- 3
Export or share
Download Markdown or PDF, or send a private link to a teammate or customer.
What you get
Severity-ordered
Findings sorted Critical → Info so the highest-impact issues are at the top.
Evidence per finding
Raw response headers, redacted secret snippets, URL paths: enough to verify, not enough to leak.
Markdown + PDF
Markdown for AI agents (one file, clean schema). PDF for compliance, audit, or customer review.
Shareable links
Send a private read-only link to a teammate or customer. No login required to view.
Filtering & grouping
Group by scanner, asset, or severity. Suppress noise once and never see it again.
Triage state
Mark findings acknowledged or known. Keeps the report honest without losing history.
Frequently asked
- Can I share the report with a customer?
- Yes. The shareable link is read-only and doesn't expose your account, billing, or other scans. Good for prospects asking about security posture.
- Is the export format stable?
- Yes. Markdown export uses a fixed schema for headings, severity tags, and fix blocks. Safe to commit into a repo or feed to an AI agent.
- What's actually in the PDF?
- Same content as the web report: severity summary, every finding with evidence and remediation, scan metadata (timestamp, target URL, scanners run). Auditor-friendly layout.
- Do reports include false-positive guidance?
- Yes. Findings flagged as 'likely informational' (public Firebase keys, Supabase anon keys, Firebase SDK error strings) are called out so reviewers don't waste time on them.