What is Webcuris?
Webcuris is a continuous security assessment platform for websites, code repositories and AI-assisted code. It scans a site the way an ordinary visitor’s browser would, analyses repositories for vulnerable dependencies and committed secrets, and re-runs those checks on a schedule so a finding that comes back is reported as a regression rather than as a new discovery.
It is built for developers, DevOps and security engineers at small and mid-sized software teams. The free plan covers one domain and one repository at no cost; paid plans start at $39 a month.
What it does
Reads what your site already gives away
Headers, cookies, TLS configuration, redirect behaviour and public DNS — the things every visitor's browser collects before it draws a pixel. The standard scan makes the requests an ordinary visit makes, which is why it is safe to point at production.
Analyses repositories and their dependencies
Committed secrets, known-vulnerable packages, and the packages that do not exist at all — the ones language models invent and attackers then register. Repository scanning can run locally, so source never leaves the machine it is on.
Re-runs both, and tells you what changed
A finding carries a lifecycle: new, still present, fixed, or regressed. A thing you fixed that comes back is reported as a regression rather than as a fresh discovery, because those are different problems and usually only one of them is about the code.
What it is not
Said plainly because the name is close to several other things, and a search engine that has guessed wrong needs a contradiction rather than another description.
Not a website builder
It does not create, host or design websites. It examines ones that already exist.
Not a web design or marketing agency
There is no services arm. It is software, sold as a subscription.
Not Web Curios
An unrelated newsletter with a similar name, published since around 2010. No connection.
Not a penetration test
It refuses the intrusive half by design, and publishes what it refuses. A scan is not a pentest and this one says so.
The fuller argument for how it decides what counts as a risk is on what confidence means, and what it refuses to do is published in the testing authorization notice.
Keep reading