Dynamic application security testing
Proof, not a list of maybes.
SekuScan drives a real browser against your application and reports a weakness only when it holds the evidence that one exists. Every finding arrives with the requests that produced it and the responses that settled it. Nothing is graded on a hunch.
Built by SekuriPy — manual, source-level security work by the author of sqlmap and Maltrail.
injection/sqli · replay minimised to 3 requests
Why you can trust the output
Three claims, each one checkable without taking our word.
A security scanner asks for credentials, network position and a view of every request your application serves. That deserves more than a datasheet.
Findings carry their evidence
A weakness is reported when the engine can demonstrate it, with the request pair that proved it and the controls it ran alongside. What it could not prove, it does not report — and says so.
no severity guessed from a bannerYou can read the half that sees your traffic
The sensor runs inside your network and observes everything. Its source is available to you — including the two files that decide whether it stays in scope and whether it redacts your secrets.
agent/scope.py · agent/redaction.pyYou prove the target is yours
Every host is verified before it can be scanned, by a DNS record or a file you place at its root, and the authorisation is recorded. A scanner that will point anywhere is a liability you inherit.
_sekuscan-verify.<host> · /.well-known/How it runs
Two halves, and a hard boundary between them.
The sensor
Opens a real Chromium against your application, performs one instruction at a time, and describes what happened. It holds no checks and no planner: it cannot decide what to test — only refuse what is out of scope and report what it saw.
The engine
Owns the crawl, the checks, the scoring and the verdicts. It reads what the sensor reports, decides the next instruction, and produces the report with the evidence attached to every finding.
The sensor connects outbound to the engine, collects its next instruction, and posts back what it observed. Your firewall changes by one outbound allowance — or by nothing at all. Nothing is ever opened inbound.
Results
Graded by other people, and published in full.
Every corpus we run is published with the date, the engine commit it was measured against and what it cost in requests — including the ones where we score worst. A recall number without its false-positive number beside it is not a measurement.
| Corpus | What it grades | Result |
|---|---|---|
| WAVSEP (ZAP team’s fork) | Every true-positive case, across 1 265 cases | 1 210 / 1 210 |
| WAVSEP false-positive traps | Look-alikes it must refuse to report | 38 / 44 |
| Crawl Maze (Google) | Reaching content buried in JavaScript, headers, CSS | 85 / 85 |
Pricing
Priced per application, not per seat.
Scanning is licensed against the hosts you have verified. Everyone on your team can read the results.
Standard
Per verified application
- Scheduled and on-demand scans
- Reports in HTML, JSON and SARIF
- CI integration, results diffed against a baseline
- Unlimited readers
Enterprise
Let’s talk
- Multiple sensors across segmented networks
- Internal applications that never touch the public internet
- Security review of the sensor source with your own engineers
- Named contact and agreed response times
Get started
Tell us what you want scanned.
We will ask which application, who owns it, and how you would like to prove that. If SekuScan is the wrong tool for what you are protecting, we would rather say so at the start than sell you a subscription.