Question 1

What is Webcuris?

Accepted Answer

Webcuris is a continuous security assessment platform for websites, code repositories and AI-assisted code. It scans a site the way an ordinary visitor's browser would — headers, cookies, TLS, DNS and redirect behaviour — analyses repositories and their dependencies for known vulnerabilities and committed secrets, and then re-runs those checks on a schedule so a finding that comes back is reported as a regression rather than as a new discovery. It is built for developers, DevOps and security engineers at small and mid-sized software teams. The free plan covers one domain and one repository at no cost; paid plans start at $39 a month. It is not a website builder and not a design agency.

Question 2

Is it safe to run against my production site?

Accepted Answer

Yes. The standard scan — what the industry calls a passive scan — only makes requests an ordinary visitor's browser would make: fetching pages, reading response headers, resolving DNS and inspecting published JavaScript. It sends nothing designed to change the target's behaviour, so it can be run against a site without prior arrangement. Active checks — which send requests a visitor would not — require proven ownership of the domain.

Question 3

What is the difference between SAST and DAST?

Accepted Answer

SAST reads source code and finds patterns that are dangerous regardless of whether they are reachable at runtime. DAST tests a running application from outside and finds what is actually exploitable, but only where it can reach. They disagree usefully: SAST reports things DAST cannot see, and DAST confirms things SAST can only suspect.

Question 4

What is blind SSRF, and why is it hard to detect?

Accepted Answer

Server-Side Request Forgery is blind when the server fetches an attacker-supplied URL but never returns the response, so nothing in the reply reveals that it happened. It is detected by supplying a URL pointing at a collector you control: if a request arrives there, the target fetched it. The interaction is the evidence, and it can arrive minutes after the scan finished.

Question 5

Does a security scanner need access to my source code?

Accepted Answer

Not for website scanning, which works entirely from what the site already serves publicly. Repository scanning does need read access, and is where secret detection, dependency vulnerabilities and static analysis happen — findings that are invisible from outside.

Question 6

Why does a scan report say a check was 'not assessed' instead of showing no findings?

Accepted Answer

Because those are different statements. 'No findings' means a check ran and found nothing; 'not assessed' means it did not run — the data was unavailable, the plan did not include it, or ownership was not verified. Reporting the second as the first is how a scan report reassures somebody about a risk nobody looked for.

Question 7

Are there security tests Webcuris refuses to perform?

Accepted Answer

Yes — seven categories, documented publicly. Credential stuffing locks real users out of their own accounts; conclusive SQL and command injection execute on somebody's production system; cache-poisoning tests serve the payload to other people's visitors. In each case the safe part is implemented and the destructive part is not, and every scan says which is which.

Question 8

How often should a website be security scanned?

Accepted Answer

Continuously, if the site changes continuously. A scan describes the day it ran: a header removed during a deploy, an expiring certificate, or a subdomain someone stood up last week will not appear until something looks again. Monitoring re-runs on a schedule and tags each finding new, persisting, fixed, or regressed against the previous run, so what reaches you is the change rather than the whole list again.

Question 9

How do you tell a real finding from a false positive?

Accepted Answer

Every finding states a confidence level alongside its severity, and the two are independent. Confirmed means the condition was observed directly. Potential means a pattern matched that is often the issue and sometimes is not, and the finding says what would settle it. A scanner that reports everything at the same certainty moves the work of separating them onto you without telling you that is what it did.

Question 10

Does automated scanning replace a penetration test?

Accepted Answer

No, and treating it as one is the more expensive mistake. Automated scanning covers breadth continuously — configuration, dependencies, exposure — which a point-in-time engagement cannot. A penetration test covers depth: chained logic flaws, business-rule abuse, and the creative reasoning no rule engine performs. Each leaves the other's ground uncovered.

Question 11

Is it legal to scan a website you do not own?

Accepted Answer

Passive observation of what a site already serves publicly is what any visitor's browser does, and is what this platform will do without further ceremony. Anything beyond that — requests a visitor would not send — requires proven ownership of the domain, established with a DNS TXT record or a file served from it. That boundary is enforced in code, not stated in a policy and trusted.

Question 12

What is LLM or AI usage risk in a codebase?

Accepted Answer

The risk that untrusted text reaches a model as if it were an instruction, and that the model's output then reaches something with authority. In practice it looks like a prompt assembled from user input with no separation, or agent tooling handed shell, filesystem, or eval access it does not need for its job. Both are visible statically, before the feature ever runs.

Question 13

What is an SBOM, and why would I need one?

Accepted Answer

A software bill of materials is the list of components a build actually contains, with versions. It is what turns a disclosure from an investigation into a lookup — which matters most on the day a widely-used package is the one disclosed. A repository scan generates one per scan.

Question 14

Where does my scan data go?

Accepted Answer

Into Webcuris's own database. No third-party backend receives findings, scan history, or audit entries, and there is no analytics or advertising tracking anywhere in the application. Every external service a scan can contact is named in the Privacy Policy, along with exactly what is sent to each, and both export and deletion are self-service.

What people ask before they scan anything.