SelfSecUse agentic DAST to find and confirm exploitable weaknesses before release, then put the managed WAF in front of your site to stop malicious traffic in production.
SelfSec DAST runs on a Windows or Linux host you own and confirms a vulnerability there. SelfSec WAF runs as a managed reverse proxy at the SelfSec edge and blocks the same attack before it reaches your origin.
The scanner finds and confirms the weakness on a host you own. The firewall enforces protection in front of your origin, on traffic we inspect for you.
The agentic scanner crawls, attacks and confirms — finding the flaws before anyone else does.
Your application
scanned from a host you run · served from your origin
Tested locally, shielded in production
The reverse-proxy firewall inspects every request inline and drops the attacks before they reach your app.
Crawl authenticated applications, attack the surface as it appears and prove exploitable behavior before it reaches the report — with core scan processing on your own machine.
Reach the real attack surface
Prove it before you report it
Know what to fix first
Synthetic SelfSec DAST preview showing confirmed findings from a live scan.
Point your domain at SelfSec and every request is inspected inline before it reaches your origin — managed rules, signed virtual patches and bot mitigation, with every block naming the rule that made it, no software on your servers and no change to your application.
Enforce in front, not inside
Patch exposure the same day
Explain every decision
Synthetic SelfSec WAF preview showing live pass and block decisions at the edge.
The products solve different moments in the same application-security loop. Use either one independently or connect both through the same account.
SelfSec DAST
Offense
SelfSec WAF
Defense
Both products are pre-release and managed from the same account. The scanner installs on a Windows or Linux host you own and activates when you sign in with your account; the WAF needs nothing installed — you prove the name is yours, then point its DNS record at it.
Cost, confidentiality and compliance decide the tool long before the feature list does. These are the situations the product line is shaped around.
Solo engineers and bug-bounty hunters carry the licence cost themselves. There is one plan and it keeps the full module set rather than crippling detection at the low end, and core scan processing stays on your machine.
See what the plan includesConsultants work under NDA, and client URLs, evidence and reports are exactly what an assessment agreement says cannot be shared. Scanning runs locally, and flat pricing means one more client is not one more seat charge.
Review reporting and exportsWhen a contract, a regulator or an internal policy governs where application data may travel, the deployment model decides the purchase. The scanner keeps core processing and findings on your host; the firewall is a service we run, so requests to a protected site are inspected by us on the way to your origin.
Read the Privacy PolicyJoin the launch list for public availability, deployment guidance and the first production-ready release.