Every check, from response headers to AI usage
Website scanning, repository analysis, AI-usage checks, monitoring, and reporting — built as one connected platform, not separate tools bolted together.
webcuris.com
What this shows: A silent screen recording moving through the product: the dashboard's posture score and fix-first queue, the attack-surface view, the findings explorer, a scan's detail page with a finding opened, dependency risk with EPSS scores, AI usage risk, compliance mapping, the report types, and the integrations page.
Real product footage on a representative dataset — not a mock-up.
Website scanning
Security headers & CSP
Checks for missing or misconfigured headers and Content-Security-Policy directives.
TLS & certificates
Certificate validity, chain, and configuration issues on the live endpoint.
DNS hygiene
SPF, DMARC, CAA, and DNSSEC posture for the target's domain.
Cookies & mixed content
Insecure cookie flags and HTTP resources loaded on HTTPS pages.
Subdomain visibility
Related subdomains discovered from public Certificate Transparency logs — nothing is sent to them.
Repository & code scanning
Dependency vulnerabilities
Known-vulnerable packages across 8 package ecosystems, resolved via OSV.dev.
Secrets detection
Hard-coded credentials and tokens caught before they ship.
Dockerfile & Kubernetes
Common container and manifest misconfigurations.
Pattern-based SAST
Rule-based static analysis for risky code patterns.
LLM / AI usage risk
Flags patterns associated with unsafe LLM integration.
Monitoring & alerting
Scheduled re-scans
Set a monitoring interval per asset and let it run unattended.
Change tracking
Every finding is tagged new, persisting, fixed, or regressed since the previous scan.
Webhook delivery
Generic JSON, or pre-formatted for Slack, PagerDuty, Datadog, or Splunk.
Cross-scan correlation
Patterns visible only across multiple scans or assets, not a single run.
Risk & compliance
Attack-path correlation
Findings chained into narrative risk paths within a scan.
Security maturity ladder
A 5-level model tracking how your program's coverage evolves over time.
Framework situational mapping
Best-effort mapping to OWASP Top 10, NIST 800-53, CIS v8, ISO 27001, and SOC 2 — not a certification.
Exportable reports
Printable scan reports, including a compliance-audience variant.
Trust & access control
Tamper-evident audit log
Hash-chained event log you can verify end-to-end at any time.
Multi-factor authentication
TOTP-based MFA with backup codes.
Scoped API keys
Bearer tokens for CLI and CI usage, independent of session cookies.
Role-based visibility
Owner and user roles, plus organization-scoped shared visibility.
Developer workflow
CI/CD gating CLI
Fail a pipeline on score thresholds with the bundled CLI.
SBOM export
Software bill of materials generated per repository scan.
In-toto attestations
Evidence that a scan ran, for supply-chain record-keeping.
Organizations
A shared scanning scope for a team, alongside personal scans.
AI assistants
MCP server
Connect Claude, ChatGPT, Cursor, Claude Code or any MCP client and ask for scans and findings in plain words.
Sign-in, not keys
Assistants connect over OAuth 2.1 with PKCE through your account; tokens are short-lived and revocable from Account → Connected assistants.
Your plan, exactly
Included in Pro and Business. The assistant has the plan's abilities and nothing more, and stops the moment the plan lapses.
Ten read-and-scan tools
Scan, status, results, open findings, SBOM, preflight, agent authorization. Nothing administrative.
Keep reading
Where most people go next
Field notes on monitoring
All articles
Your monitoring is watching the wrong end of the request
Our uptime monitor was green while every visitor saw an unstyled page. It was the second time every server-side signal agreed the site was fine while the browser disagreed — and the two incidents share a shape worth naming.
Vulnerability Scanning vs Security Monitoring: You Probably Need the One You Don't Have
A scan answers what is wrong now. Monitoring answers what changed since it was right. Most teams buy the first and need the second — because the expensive incidents are almost always something that used to be correct.
5 min read
Passive vs Active Security Scanning: What a Scanner Should Refuse to Do to Your Site
The line between observing a site and attacking one is sharper than vendors make it sound. What passive scanning can honestly find, what genuinely needs active testing, and the tests we refuse to run — with reasons.
2 min read
See it on your own targets
Create an account and run your first scan in minutes.