Reading a finding
Severity is a claim. Confidence is the honesty.
Any scanner can print a red badge. Every Webcuris finding also states how sure the scanner is — so you can tell a measured fact from a pattern that merely looks wrong, and spend your time accordingly.
The four levels
Confirmed
confirmedThe scanner saw it. The header was absent from the response, the protocol negotiated, the cookie arrived without the attribute. There is no interpretation between the observation and the finding.
- What to do
- Treat as fact and fix on merit. If you disagree, the evidence on the finding is the thing to check.
- Example
- A missing Strict-Transport-Security header — the response either carried it or it did not.
Strong indication
strong-indicationNot directly observed, but matching a pattern that is almost never anything else — a structured credential with a recognisable prefix and checksum, or a package name that resolves nowhere in the registry.
- What to do
- Act on it. Verify the specific instance before anything destructive, such as rotating a key.
- Example
- An AWS access key pattern in a config file. The format is distinctive enough that a coincidence is unlikely.
Potential
potentialThe shape of a problem is present in code or configuration, but whether it is reachable by untrusted input is not something a scanner standing outside can determine. Every code-pattern and LLM-risk finding lands here by design.
- What to do
- Review it with the context you have and the scanner does not. Some of these are real, some are safe by a control the scanner cannot see.
- Example
- A prompt built by string concatenation. Whether attacker-controlled input reaches that string depends on code paths the scanner did not trace.
Informational
informationalSomething observed and worth knowing, which is not itself a weakness — a disclosed framework version, a cookie set by a third party. It is recorded so the surface is described completely, not to inflate a count.
- What to do
- Read it once. No action is implied.
- Example
- A Server header naming the web server and version.
Confidence and severity are independent. A finding can be critical and potential at once — the consequence would be severe if it is real, and whether it is real is what you are being asked to judge. Collapsing the two into one number is how a queue stops meaning anything.
Straight answers
The questions people actually ask.
Including the ones with answers a vendor would rather not print.
Is Webcuris SOC 2 or ISO 27001 certified?
No. Webcuris holds no SOC 2, ISO 27001, or third-party penetration test. The compliance mappings in the product are situational context — they show which findings relate to which control — and are not audit evidence or a claim that any criterion is satisfied. If you need an audited certification today, another vendor is the correct answer.
Will scanning affect or slow down my website?
No. External checks are passive and equivalent to a handful of ordinary browser requests — the same traffic any visitor generates. Checks that go beyond what a browser would do stay locked until you prove you control the domain, by DNS record or hosted file, and authorisation is recorded per scan rather than once per account.
Who can see my scan results, and can I delete them?
Findings, scan history and audit entries are written to this deployment's own database and are not shared with or sold to anyone. There are no analytics or advertising trackers in the product. You can export everything held about you and erase your account yourself from the account page — no request queue and no waiting on support.
Can a Webcuris finding be wrong?
Yes. False positives and false negatives both happen, which is exactly why every finding carries a confidence level rather than a bare severity badge. Confirmed means the scanner observed it directly; potential means a pattern worth reviewing, not a proven defect. A scanner that never told you which was which would be asking you to trust all of it equally.
Keep reading