Run a scan

Read a result

The target page opens on Findings. Evidence is the redacted copy. The raw secret is not stored.

1. 01

   Start with Findings

   Each row shows a severity, a title, the suite, the route, the identity that received the response, the HTTP status, and a category. Open means the finding has not been dismissed.

2. 02

   Use the other tabs

   APIs is the captured catalog. Routes is the distinct method and path pairs, including wordlist hits. Scans is the history, with routes discovered, API calls captured, and findings emitted. Identities is where you add a second account.

3. 03

   Mark a row when you are done with it

   Mark a finding resolved, false positive, or intentionally public. A suppressed category is skipped on later scans of that target. Download report saves the open findings as Markdown. JSON returns the same report for a script.

Severity   HIGH
Suite      Unguarded access
Route      GET /api/users
Identity   Anonymous
Status     200
Evidence   email [REDACTED_EMAIL] · phone [REDACTED_PHONE]