Product · Security Reports
A report you can hand to anyone: your team, your customer, your AI.
Live-app reports describe observed URL behavior; repository reports describe selected source files and lines. Review available evidence, coverage and suggested fixes. Export and sharing options depend on the report type and your access.
- Full severity breakdown: Critical, High, Medium, Low, Info
- Available evidence and coverage limits
- Markdown export for Claude, Cursor, and Windsurf
- Live-app report sharing and PDF; separate code-report format
2
Critical
5
High
11
Medium
8
Low
Source scanning has a different evidence format. View the fictional code report.
- Exposed Supabase service_roleCRIT
- Missing CSP headerHIGH
- Mixed content on /pricingMED
How it works
3 steps to your first result.
- 1
Run a scan
Report is built automatically, nothing to configure.
- 2
Filter and triage
Sort by severity, scanner, or asset. Mark items as known/acknowledged.
- 3
Export or share
Use the export options available for that report and plan. Live-app sharing and code-report export are separate features.
What you get
Severity-ordered
Findings sorted Critical → Info so the highest-impact issues are at the top.
Evidence per finding
URL reports use observed response and page evidence. Code reports use supported source-file and line evidence. Review exports for sensitive content before sharing.
Markdown + PDF
Live-app reports support available Markdown and PDF exports. Code reports have a separate AI-ready export. Suggested changes require review, not blind application.
Shareable links
Available live-app share links allow viewing without login. Treat the link as sensitive. This is not a public-sharing promise for repository reports.
Filtering & grouping
Group by scanner, asset, or severity. Suppress noise once and never see it again.
Triage state
Mark findings acknowledged or known. Keeps the report honest without losing history.
Frequently asked
- Can I share the report with a customer?
- Live-app reports support read-only share links where available. Review the report before sharing and treat the link as sensitive. Repository reports use separate access and export rules; neither report is a security certification.
- Is the export format stable?
- Available exports organize findings, evidence and suggested changes for review. Check for sensitive content before sharing or sending to an AI tool, and review proposed changes before applying them. Report types have different export options.
- What's actually in the PDF?
- Same content as the web report: severity summary, every finding with evidence and remediation, scan metadata (timestamp, target URL, scanners run). Auditor-friendly layout.
- Do reports include false-positive guidance?
- Yes. Findings flagged as 'likely informational' (public Firebase keys, Supabase anon keys, Firebase SDK error strings) are called out so reviewers don't waste time on them.