Docs/Scanning

Vulnerability Scanning

Run web and infrastructure scans and understand the profiles.

Video walkthrough coming soon

The written steps below cover everything in the meantime.

What you'll learn

  • The difference between the scan profiles
  • Which profile to use for a URL vs an IP vs a repo
  • How results are deduplicated across scans

Step-by-step

  1. 1

    Pick a profile

    Full Security Audit (nmap, nuclei, testssl, zap) is the general-purpose choice. Deep Infrastructure Scan focuses on network/host checks. Nikto Web Scan and Web Application Audit are web-focused.

  2. 2

    Match input to profile

    Web/infra profiles need a target (URL/IP/domain). Code profiles (semgrep, gitleaks) need a git repository instead — see Code Intelligence.

  3. 3

    Launch and wait

    Start the scan and let it complete in the background. You can queue several scans across different targets.

  4. 4

    Deduplication

    The same issue found across multiple scans is collapsed into one finding with first-seen, last-seen, and a scan count. Issues that stop appearing are auto-resolved.