Team access and audit trails, without becoming another vendor to review.
Every outbound call a scan makes is enumerated in the subprocessor register, findings are exportable and deletable on demand, and the audit log is tamper-evident — the answers a security review asks for, published before it asks.
Governance and access control
Access is something the platform can prove, not something it promises: the audit chain, the role model, and the key lifecycle below are all inspectable from inside the product.
Tamper-evident audit log
Every security-relevant action — logins, scans, settings changes, verification attempts — records actor, action, target, and IP into a hash chain. Each entry hashes the previous one, so altering history breaks the chain, and an owner can verify it on demand.
Role-based access and data isolation
Two roles, owner and user. A user sees only the assets they created and the scans they personally triggered; another account's scan returns 404 rather than 403, so its existence is never confirmed to someone without access.
Organizations
A shared scanning scope for a team, layered alongside personal scans rather than replacing them. Run a scan as an organization and every member can open it. Members join through single-use, expiring, hash-stored invite links.
API keys and CI/CD gating
Keys inherit the role of the account that created them, are shown once, stored only as a SHA-256 hash, and can be revoked instantly. The bundled CLI fails a pipeline below a score threshold you choose.
Enterprise
Your logo. Your client’s name. Not ours.
If you assess other people’s systems for a living, the report is your deliverable. White-label reporting puts your mark, your colour and your contact details on every one of them, and names the client each was prepared for — in the document and in the title your browser prints at the top of the PDF.
- All nine report types — technical report, compliance view, developer report, hardening config, attacker's view, incident runbook, executive report, remediation plan and ai security report.
- One client name per domain, so an agency with twelve clients gets twelve correctly-headed reports.
- Your logo, your accent colour, your contact line, your confidentiality footer.
- Only the URL your browser prints beside the title is still ours — one checkbox in the print dialog removes it.
One thing stays: the sentence saying an automated scan can produce false positives and is not a certification. It is true of the engine whoever’s logo is at the top, and a report is exactly where it matters. Your own wording is added beneath it.
Security Scan Report
acme.example
https://acme.example
Northgate Security
security@northgate.example
- Scope
- 1 domain
- Prepared for
- Acme Ltd
Missing Strict-Transport-Security
DOM sink writes HTML
Cookie without SameSite
Confidential. Prepared for the named client and not for onward distribution.
Illustration — Northgate Security is not a real customer
Deployment and operations
One deployment, no hidden backend
Scan results, findings, and audit history live in Webcuris's own database and nowhere else. Every external service a scan contacts is enumerated in the subprocessor register, and export and account deletion are self-service.
Two-factor authentication
Optional TOTP enrollment per account (RFC 6238, any standard authenticator app) with one-time backup codes. Disabling it requires re-entering the account password.
Rate limiting on every account surface
Failed logins, signups, MFA attempts, and scan submissions are all bounded. Counters live in the database rather than in memory, so a lockout survives a restart and holds across every process serving the service.
Alerting into tools you already run
Monitoring alerts deliver as generic JSON, or pre-formatted for Slack, PagerDuty, Datadog, or Splunk HEC. Destination URLs are SSRF-guarded when saved and again before each delivery.
What this is not, stated up front.
A security vendor that only lists strengths is asking you to do the discovery yourself. These are the gaps that matter most to an enterprise evaluation, and they are the same ones listed in the Security Policy.
Read the full limitations- Single sign-on with Google and GitHub, on a provider-verified email address. No SCIM — accounts and roles are still managed inside Webcuris.
- No encryption at rest for the database file itself. Sensitive fields — scan evidence, TOTP secrets, repository tokens — are sealed individually; the file around them is not.
- Organizations are deliberately minimal: no nested teams, org-level keys, or org-level billing.
- No SOC 2, ISO 27001, or third-party penetration test. The compliance mappings are situational context, not audit evidence.
Keep reading
Where most people go next
Evaluate it against a real target
Nothing to request, no sales call — sign up and scan something you own.