Skip to content
Scanlity

Choose your scope.

Review what you built, from public website signals to configured code and application checks.

Check a website

Different questions.
Declared limits.

A public scan, source review and access check have different inputs. Choose the evidence you need.

Public website

Inspect supported public pages, headers, TLS, DNS, exposed information and browser privacy signals. Missing checks stay visible.

No website login is needed. This review cannot assess private authorization or business logic.

Review a website

Code & pull requests

Review supported source, secrets, configuration and npm dependencies. Configured repository reviews keep findings tied to an exact commit and comparable baseline.

Supported analyzers and GitHub App access require setup. A code result does not establish the behavior of a deployed application.

Open code review tools

Authenticated app

Compare declared GET/JSON resources across synthetic roles and tenants. Keep access expectations, evidence and retests tied to the reviewed environment.

Requires verified domain control, explicit consent and short-lived synthetic sessions. No write operations or automated login.

Configure an application

Website features

The public website flow is the simplest place to begin. Account access adds evidence and history within the beta allowance.

Public website reviews
Start with a domain. A passive review checks publicly visible behavior without a website login.
Security score & priorities
An observed score, risk scenarios and prioritized findings. Incomplete security checks make the assessment provisional.
Full findings & practical fixes
See all recorded findings and recommended next steps. Maintenance advice stays separate from actionable security risks.
Evidence you can inspect
Save a review to inspect the collected evidence in your account. Public summaries omit raw evidence and secret values.
Privacy, trust & polish
Review observable tracking and consent signals, privacy links, contact details and website presentation. These observations do not establish legal compliance.
Saved websites & scan history
Keep your own sites and client reviews together, and reopen a specific dated result. Open versioned trends and configure daily or weekly reviews in workspace tools.
Client view & browser printing
Present an authenticated client view and print a dated review with its scope and limitations. Workspace tools also generate a hosted PDF from a selected dated scan.
Expiring public summaries
A public review has a seven-day bearer link. Anyone with the link can read its summary; saving requires the original browser and an account.

Keep the review useful.

These tools are in beta. Delivery needs configuration, optional AI needs a local model, and custom domains need DNS and HTTPS. Specialist work requires a separate provider agreement.

Code & application reviews

Connect code and a deployed environment after operator setup and your authorisation. Each review keeps its defined scope.

Account tools · beta

GitHub repository & PR reviews
Connect selected repositories for exact-commit JavaScript and TypeScript reviews, secret candidates and configured npm dependency checks. Compare PR results with a baseline, use opt-in summary comments and export private HTML or SARIF. Requires a configured GitHub App; repository code is not executed.
Authenticated application access checks
Verify an environment you control, connect short-lived test sessions and check a defined read-only JSON matrix between users, tenants and administrators. Ownership proof and explicit consent are required. This is not a complete application penetration test.
Code review → deployed-version check
Open a recorded code review, select an authorised environment and test its declared commit and deployment. The manifest is compared before and after the run. Linked results retain their separate scopes; preview discovery is not automatic. Configured GitHub deployment events can trigger checks after explicit owner opt-in.
Repair tasks for your coding agent
Copy or download a finding's repository, exact commit, rule, location and repair instructions. Selected TLS findings also support a reviewable patch preview. Applying the change and retesting remain explicit steps; downloading a task does not modify code.

Monitoring, code & reporting

Monitoring, remediation help, developer integrations and richer reporting.

Account tools · beta

Continuous monitoring
Schedule daily or weekly reviews, compare observations and send email or configured Slack alerts. Delivery needs a running worker; this is not instant detection.
Fix it for me
Record a request, provider scope and quote, explicit acceptance and resolution. An actual specialist must agree the work; Scanlity does not automatically supply a provider or charge for repairs.
CI/CD integration
Use the included CI client with a scoped API key to submit website reviews, wait for results and enforce severity and incomplete-coverage policies.
AI code scanner
Submit bounded source code for heuristic review and optional local AI analysis. Requires a configured local model for AI; source is not executed and findings need review.
Score tracking & trends
Chart dated observations with engine and catalog versions, and inspect comparable score changes without treating incomplete checks as passing.
Advanced reports
Generate private hosted PDFs with selected sections, branding, business context and explicit OWASP Top 10:2021 mapping. No compliance certification.

Portfolio & reporting

From a single website to repeatable client handovers.

Account tools · beta

CSV import & bulk scans
Preview and deduplicate an import, then follow each queued review within your allowance.
White-label reports
Configure your own brand, logo and report owner for client-facing output.
Private report sharing
Create a scoped link to an immutable account report, with expiry and revocation. Separate from anonymous public scan summaries.
Custom report domains
Prove control with a DNS TXT challenge, then use tenant-bound report routing. You must also configure DNS routing and HTTPS in your hosting platform.
Handover reports & dated badges
Reference the exact scan, scope and date when handing over a website. A badge does not certify that a site is secure.
Monthly client reports
Summarize scheduled reviews and their limitations for clients over an actual reporting period.

Verified sites & collaboration

More context, controlled access and clear responsibility.

Account tools · beta

Domain ownership verification
Prove domain control through a DNS or file challenge, with expiry and re-verification.
Verified checks
After expiring ownership proof and explicit consent, inspect response headers on up to three fixed public paths. Bounded checks do not bypass authentication or constitute a penetration test.
Teams & roles
Invite colleagues, manage roles and remove access, with workspace isolation and seat limits.
Lead capture widget
An agency-branded review entry point with contact consent, lead management and abuse controls.

Developer tools & insight

Make results useful in development and decision-making.

Account tools · beta

Developer API
Authenticated scan and result access with scopes, rate limits and an audit trail.
Side-by-side website comparison
Compare results with matching scope and engine versions. Differences do not establish that one site is secure.
Benchmarks & security index
Opt in to share anonymous versioned score metrics. Percentiles need at least ten comparable, complete contributed scans; the sample is not a representative global index.
AI-assisted fix guidance
Request optional local-model guidance with explicit consent and redacted inputs. Model configuration is required; AI does not decide findings, severity or scores.
Business-impact context
Explain findings in language useful to owners and stakeholders. Any future loss estimates will need explicit assumptions and supporting data; no breach-cost figures are invented.
OWASP & framework mapping
Explain how supported findings relate to documented categories. A category mapping is not complete OWASP coverage or a compliance audit.

Start with your website.

Your first public review is free. No account or card required.

Check a website Understand the scope