Your site looks fine. Look underneath.

Single-page instant scan

Paste any URL and get a complete security snapshot across all 8 layers in under 15 seconds. No account, no setup.

JavaScript CVE detection

Retire.js + OSV database checks against every JS library identified on the page. Pinpoints the exact file and version with the CVE ID linked.

Third-party domain mapping

Every external domain your page contacts - categorised by purpose, checked for registration age, and flagged if they match threat intelligence signals.

Security score and grade

Every scan produces a weighted 0-100 score and A-F grade calculated from finding severity across all 8 layers. Comparable across scans over time.

Independent Active Testing Score

Active-testing checks are scored separately from your overall report - a dedicated grade for what was actively probed, alongside your regular security score.

API endpoint discovery & testing

Finds REST, GraphQL, and SOAP APIs via OpenAPI/Swagger specs, GraphQL introspection, WSDL definitions, and a common-path scan of both a wordlist and your site's own JavaScript - then runs safe, non-destructive tests on each: does it require auth when it should, is GraphQL introspection left open in production, does it leak data via misconfigured CORS.

Sandboxed, consent-gated testing

Each run happens in an ephemeral, isolated sandbox with network egress scoped to only the domain being tested. Requires its own explicit consent checkbox on top of Active Testing's - real exploitation attempts, not passive observation.

Evidence package bundling

The Pentest Report PDF is bundled into the same audit evidence ZIP export as your main and DAST reports, ready to hand to an auditor without hunting down a third download.

Live scan telemetry & config summary

See real request counts, throttle rate, and retries as a scan runs, and every finished report carries a summary of exactly which Scan Profile settings applied - so what ran is never a guess.

Subdomain discovery

Finds forgotten staging, dev, and admin subdomains via common-name enumeration plus a certificate transparency log lookup (real hostnames a public CA has issued a certificate for), with a quick reachability check on each - and a one-click button to run a full scan on any of them.

Open port & service discovery for IP scans

When you scan a bare IP directly, a passive connect-only probe checks common non-web service ports (databases, remote access, file transfer) for exposure, captures any banner offered, and runs a reverse DNS (PTR) lookup - never sends payloads or attempts exploitation.

Source map analysis

When an exposed .map file is found, the agent fetches it and reconstructs original source to check for hardcoded secrets and internal architecture leaks.

Per-finding remediation

AI-written remediation steps specific to each finding - not generic advice. Tells your developer exactly what to change and why.

Shareable public link

Every free report gets a public URL you can send to a developer, client, or auditor. Sign up to save reports to your account permanently.

Comparison reports

Side-by-side diff between any two scans of the same site. See exactly what findings are new, what has been resolved, and what has changed severity.

OWASP Top 10 coverage checklist

Every report includes an explicit checklist mapping each OWASP Top 10:2025 category to what was actually tested - confirmed finding, clean, or not tested - so coverage against the industry's best-known standard is citable, not something you have to infer. Included on every scan, even free.

NIS2 control mapping

Findings tagged to NIS2 Article 21 risk-management measures - built for the EU directive’s October 2026 compliance deadline, now covering roughly 160,000 in-scope entities.

PCI DSS control mapping

Findings tagged to PCI DSS v4.0 requirements - including a strong, specific match for the payment-page script inventory and change/tamper-detection rules introduced against Magecart-style card skimming, exactly the ground Decloak’s tag-manager and third-party-script findings already cover.

Remediation tracking

Mark each finding as Open, In Progress, Resolved, or Accepted Risk and assign it to a teammate - upgrades the Priority Remediation Plan and All Findings from view-only to fully editable. Auditors need to see that findings are being acted on - this closes that loop.

Scheduled recurring scans

Set a weekly, monthly, or quarterly cadence and scans run automatically. Never miss a security check-in for SOC2, ISO 27001, NIS2, DORA, LGPD, PCI DSS, NIST CSF or EU CRA again.

Webhook integration

Push findings to any system - Jira, Linear, PagerDuty, or your own. Signed payloads (HMAC), per-endpoint event selection, and a delivery log.

AI assistant

A chat assistant that knows your scan results - ask it to explain a finding, walk through remediation, or find the right guide, right from the report or dashboard you're already on.

Multi-user access

Invite team members with role-based permissions. Developers see findings and remediation; managers see scores and reports; admins manage everything.

Single-page instant scan

Paste any URL and get a complete security snapshot across all 8 layers in under 15 seconds. No account, no setup.

JavaScript CVE detection

Retire.js + OSV database checks against every JS library identified on the page. Pinpoints the exact file and version with the CVE ID linked.

Third-party domain mapping

Every external domain your page contacts - categorised by purpose, checked for registration age, and flagged if they match threat intelligence signals.

Security score and grade

Every scan produces a weighted 0-100 score and A-F grade calculated from finding severity across all 8 layers. Comparable across scans over time.

Independent Active Testing Score

Active-testing checks are scored separately from your overall report - a dedicated grade for what was actively probed, alongside your regular security score.

API endpoint discovery & testing

Finds REST, GraphQL, and SOAP APIs via OpenAPI/Swagger specs, GraphQL introspection, WSDL definitions, and a common-path scan of both a wordlist and your site's own JavaScript - then runs safe, non-destructive tests on each: does it require auth when it should, is GraphQL introspection left open in production, does it leak data via misconfigured CORS.

Sandboxed, consent-gated testing

Each run happens in an ephemeral, isolated sandbox with network egress scoped to only the domain being tested. Requires its own explicit consent checkbox on top of Active Testing's - real exploitation attempts, not passive observation.

Evidence package bundling

The Pentest Report PDF is bundled into the same audit evidence ZIP export as your main and DAST reports, ready to hand to an auditor without hunting down a third download.

Live scan telemetry & config summary

See real request counts, throttle rate, and retries as a scan runs, and every finished report carries a summary of exactly which Scan Profile settings applied - so what ran is never a guess.

Subdomain discovery

Finds forgotten staging, dev, and admin subdomains via common-name enumeration plus a certificate transparency log lookup (real hostnames a public CA has issued a certificate for), with a quick reachability check on each - and a one-click button to run a full scan on any of them.

Open port & service discovery for IP scans

When you scan a bare IP directly, a passive connect-only probe checks common non-web service ports (databases, remote access, file transfer) for exposure, captures any banner offered, and runs a reverse DNS (PTR) lookup - never sends payloads or attempts exploitation.

Source map analysis

When an exposed .map file is found, the agent fetches it and reconstructs original source to check for hardcoded secrets and internal architecture leaks.

Per-finding remediation

AI-written remediation steps specific to each finding - not generic advice. Tells your developer exactly what to change and why.

Shareable public link

Every free report gets a public URL you can send to a developer, client, or auditor. Sign up to save reports to your account permanently.

Comparison reports

Side-by-side diff between any two scans of the same site. See exactly what findings are new, what has been resolved, and what has changed severity.

OWASP Top 10 coverage checklist

Every report includes an explicit checklist mapping each OWASP Top 10:2025 category to what was actually tested - confirmed finding, clean, or not tested - so coverage against the industry's best-known standard is citable, not something you have to infer. Included on every scan, even free.

NIS2 control mapping

Findings tagged to NIS2 Article 21 risk-management measures - built for the EU directive’s October 2026 compliance deadline, now covering roughly 160,000 in-scope entities.

PCI DSS control mapping

Findings tagged to PCI DSS v4.0 requirements - including a strong, specific match for the payment-page script inventory and change/tamper-detection rules introduced against Magecart-style card skimming, exactly the ground Decloak’s tag-manager and third-party-script findings already cover.

Remediation tracking

Mark each finding as Open, In Progress, Resolved, or Accepted Risk and assign it to a teammate - upgrades the Priority Remediation Plan and All Findings from view-only to fully editable. Auditors need to see that findings are being acted on - this closes that loop.

Scheduled recurring scans

Set a weekly, monthly, or quarterly cadence and scans run automatically. Never miss a security check-in for SOC2, ISO 27001, NIS2, DORA, LGPD, PCI DSS, NIST CSF or EU CRA again.

Webhook integration

Push findings to any system - Jira, Linear, PagerDuty, or your own. Signed payloads (HMAC), per-endpoint event selection, and a delivery log.

AI assistant

A chat assistant that knows your scan results - ask it to explain a finding, walk through remediation, or find the right guide, right from the report or dashboard you're already on.

Multi-user access

Invite team members with role-based permissions. Developers see findings and remediation; managers see scores and reports; admins manage everything.

Vibe-coded platform security

Detects the most common security failures in apps built with Lovable, Supabase, Base44, Bubble, and similar AI app builders - publicly readable databases, exposed service_role keys, and known platform CVEs.

CMS & platform fingerprinting

Detects the CMS or e-commerce platform a site runs on - WordPress, Joomla, Drupal, Magento, Shopify, Wix, Squarespace, Webflow, and more - and checks any self-hosted, version-disclosed platform against the National Vulnerability Database.

Tag manager intelligence

Identifies every GTM container, lists all active tags and their firing triggers, and flags tags sending data to unrecognised or newly-registered domains.

Active Security Testing (DAST)

Enterprise scans go beyond passive observation with safe, non-destructive active probes - forced browsing, reflected-input canaries, CORS and HTTP-method checks, postMessage handler auditing, and more.

Executive DAST report (PDF)

A standalone, boardroom-ready PDF scoped to Active Testing results only - severity donut, a full "what we tested" checklist, and remediation excerpts.

Proof-of-exploit evidence

Every confirmed finding carries the exact request and response that proved it, not just a plausible-looking signal - and results that were blocked or inconclusive (a WAF, a TLS handshake failure) are labelled as such rather than shown as a false clean or false positive.

Standalone Pentest Report PDF

A dedicated, auditor-ready PDF scoped to pentest results only - proof-of-exploit evidence included - separate from both your main report and your DAST report.

Per-tool AI Pentesting control

Turn individual tools (sqlmap, dalfox, commix, nuclei exposure, out-of-band SSRF/XXE, ffuf, jwt_tool) on or off per Scan Profile, exclude specific paths from testing, and opt into an Aggressive tier (elevated sqlmap risk/level, dalfox WAF-bypass) behind its own explicit liability confirmation.

SSL/TLS certificate analysis

Certificate issuer, expiry, protocol version, cipher suite, and key strength - flagging weak or expiring certificates before they become an outage or a warning page.

IP address & bare domain scanning

Scan a bare domain or IP directly - no scheme required. Automatically tries HTTPS, HTTP, and common alternate ports, and always reports what it found.

Live reasoning trace

Watch the agent explain every decision in real time as it investigates. Each step is logged with the finding that triggered it - useful as an audit trail.

Domain threat intelligence

Every third-party domain your site contacts is checked against a live malware/phishing database and flagged for suspicious registration patterns (unusual TLDs, numeric-heavy names).

AI executive summary

Plain-English summary of your security posture written by an LLM that has read all findings holistically. Readable by a CTO, auditor, or board member.

Full scan history

Every scan you run is preserved indefinitely. Filter by domain, date, or severity to find any past report instantly.

White-label PDF branding

Put your own logo, name, accent colour, and font on every PDF report, DAST report, and evidence package you export - no Decloak branding, ready to hand straight to your clients.

SOC2 criteria mapping

Findings tagged to SOC2 Trust Services Criteria (Security, Availability, Confidentiality). Makes it straightforward to respond to auditor questions by control.

LGPD control mapping

Findings tagged to LGPD (Lei Geral de Proteção de Dados) security articles - Brazil’s data protection law, the framework Brazilian compliance buyers ask for first.

EU Cyber Resilience Act (CRA) mapping

Findings tagged to the Cyber Resilience Act’s Annex I security and vulnerability-handling requirements, so existing scans double as supporting evidence if you sell software or connected products into the EU.

Audit activity log

A per-domain log of every scan, deletion, and finding change - who did it and when. Recorded from day one, so it’s already there the moment you upgrade to Pro.

Slack notifications

New critical findings delivered to a Slack channel of your choice within minutes. Useful for security channels and on-call workflows.

MCP server for AI agents

Let Claude, Cursor, or any MCP-compatible AI agent trigger scans and poll results directly - create_scan, get_scan, list_scans, and wait_for_scan tools, no glue code required.

Multi-domain dashboard

Your account shows all scans organised by domain - current grade, last scanned, open findings. Free for all accounts. Pro adds team sharing and bulk actions.

Vibe-coded platform security

Detects the most common security failures in apps built with Lovable, Supabase, Base44, Bubble, and similar AI app builders - publicly readable databases, exposed service_role keys, and known platform CVEs.

CMS & platform fingerprinting

Detects the CMS or e-commerce platform a site runs on - WordPress, Joomla, Drupal, Magento, Shopify, Wix, Squarespace, Webflow, and more - and checks any self-hosted, version-disclosed platform against the National Vulnerability Database.

Tag manager intelligence

Identifies every GTM container, lists all active tags and their firing triggers, and flags tags sending data to unrecognised or newly-registered domains.

Active Security Testing (DAST)

Enterprise scans go beyond passive observation with safe, non-destructive active probes - forced browsing, reflected-input canaries, CORS and HTTP-method checks, postMessage handler auditing, and more.

Executive DAST report (PDF)

A standalone, boardroom-ready PDF scoped to Active Testing results only - severity donut, a full "what we tested" checklist, and remediation excerpts.

Proof-of-exploit evidence

Every confirmed finding carries the exact request and response that proved it, not just a plausible-looking signal - and results that were blocked or inconclusive (a WAF, a TLS handshake failure) are labelled as such rather than shown as a false clean or false positive.

Standalone Pentest Report PDF

A dedicated, auditor-ready PDF scoped to pentest results only - proof-of-exploit evidence included - separate from both your main report and your DAST report.

Per-tool AI Pentesting control

Turn individual tools (sqlmap, dalfox, commix, nuclei exposure, out-of-band SSRF/XXE, ffuf, jwt_tool) on or off per Scan Profile, exclude specific paths from testing, and opt into an Aggressive tier (elevated sqlmap risk/level, dalfox WAF-bypass) behind its own explicit liability confirmation.

SSL/TLS certificate analysis

Certificate issuer, expiry, protocol version, cipher suite, and key strength - flagging weak or expiring certificates before they become an outage or a warning page.

IP address & bare domain scanning

Scan a bare domain or IP directly - no scheme required. Automatically tries HTTPS, HTTP, and common alternate ports, and always reports what it found.

Live reasoning trace

Watch the agent explain every decision in real time as it investigates. Each step is logged with the finding that triggered it - useful as an audit trail.

Domain threat intelligence

Every third-party domain your site contacts is checked against a live malware/phishing database and flagged for suspicious registration patterns (unusual TLDs, numeric-heavy names).

AI executive summary

Plain-English summary of your security posture written by an LLM that has read all findings holistically. Readable by a CTO, auditor, or board member.

Full scan history

Every scan you run is preserved indefinitely. Filter by domain, date, or severity to find any past report instantly.

White-label PDF branding

Put your own logo, name, accent colour, and font on every PDF report, DAST report, and evidence package you export - no Decloak branding, ready to hand straight to your clients.

SOC2 criteria mapping

Findings tagged to SOC2 Trust Services Criteria (Security, Availability, Confidentiality). Makes it straightforward to respond to auditor questions by control.

LGPD control mapping

Findings tagged to LGPD (Lei Geral de Proteção de Dados) security articles - Brazil’s data protection law, the framework Brazilian compliance buyers ask for first.

EU Cyber Resilience Act (CRA) mapping

Findings tagged to the Cyber Resilience Act’s Annex I security and vulnerability-handling requirements, so existing scans double as supporting evidence if you sell software or connected products into the EU.

Audit activity log

A per-domain log of every scan, deletion, and finding change - who did it and when. Recorded from day one, so it’s already there the moment you upgrade to Pro.

Slack notifications

New critical findings delivered to a Slack channel of your choice within minutes. Useful for security channels and on-call workflows.

MCP server for AI agents

Let Claude, Cursor, or any MCP-compatible AI agent trigger scans and poll results directly - create_scan, get_scan, list_scans, and wait_for_scan tools, no glue code required.

Multi-domain dashboard

Your account shows all scans organised by domain - current grade, last scanned, open findings. Free for all accounts. Pro adds team sharing and bulk actions.