MenuClose
Docs menuClose
Docs
How to run a scan
Each page is one job: the steps, then an example of what you type or what comes back. The five suites each have their own page.
Start
Run a scan
- Add a targetAdd one application on one host before the first signed-in scan.
- Prove you own the hostPublish the token before a security scan is allowed to run.
- Run a scanQueue a normal scan or a login scan after the host is verified.
- Read a resultUse Findings, APIs, Routes, and Scans to see what the worker recorded.
- Scan again after a fixRun the same target again and compare the new result with the previous one.
The five suites
- API catalogThe list of calls the running page already made. The other four suites start from this list.
- Unguarded accessReplay each captured call with no session and flag data that still comes back.
- Cross-user / IDORReplay User A’s captured call with User B’s credentials, keeping the original URL and body.
- Secret and PII exposureClassify responses for tokens, cards, password hashes, emails, and stack traces.
- Sensitive pathsProbe forgotten paths such as /debug, /.env, /actuator, and /.git.
On the target
Public check
Questions
- Do I have to prove I own the host?
- A security scan does. Publish the token as a DNS TXT record, or at /.well-known/routelint-verification.txt, and Routelint checks it before the scan runs. The public SEO check does not. Production targets still ask for an extra confirmation.
- What does a scan without an account show?
- One scan per browser returns counts and severities. Titles, routes, and evidence stay on the server until you sign in and claim the scan.
- What does an account include?
- Signup is an individual account. It includes the five test suites, the full security report, identities, and the SEO and GEO check rows. Payments and daily scans are coming soon.
- What does the SEO and GEO check cover?
- It reads public HTML: the page, a few links on the same host, robots.txt, an XML sitemap, and llms.txt. Scores, row names, and pass, warn, or fail are public. The evidence behind a row stays on the server until you sign in. The security suites stay on the scan product.