Reach the real attack surface
Render modern applications, survive two-factor login walls and turn newly discovered routes into attack targets while the crawl is still running.
Agentic DAST · Self-hosted on Windows or Linux
Turn a live app into confirmed, actionable findings.
Crawl authenticated applications, attack the surface as it appears and prove exploitable behavior before it reaches the report — with core scan processing on your own machine.
- Pre-release
- Windows and Linux
- Local findings database
Synthetic live DAST preview showing authenticated crawling, attack progress and confirmed findings.
21Vulnerability modules
19Database engines fingerprinted
71WAF and bot vendors
LocalCore scan processing
SelfSec DAST outcomes
What changes when SelfSec DAST is in the loop
Start with the result your team needs, then inspect the technical depth behind it.
Prove it before you report it
A finding starts as Possible and only becomes Confirmed when independent evidence says so — a dialog that actually fired, a timing differential that survives its baseline, a callback from the target's own infrastructure.
Know what to fix first
Every CVE-bearing finding carries a CVSS 4.0 vector, whether CISA lists it as known-exploited, its EPSS exploitation probability and an SSVC decision — so the queue orders itself.
How it works
Four steps, one continuous workflow
A clear path from first contact with the application to evidence your team can act on.
01
Discover
The browser-driven crawler renders the target, maintains authenticated state and adds newly observed routes to a shared queue.
02
Attack
Classical modules and adaptive evasion test the live surface while the crawl continues instead of waiting for a separate phase.
03
Confirm
Timing differentials, browser proof and out-of-band callbacks promote a finding from Possible to Confirmed — or refute it outright.
04
Export
The local findings database produces HTML, JSON and Markdown reports, SARIF 2.1.0 for GitHub code scanning and a MITRE ATT&CK Navigator layer, without uploading the report to the account site.
Finding lifecycle
Confirmation is a stage, not an adjective
Most scanners hand you a severity and leave the verification to you. Here a finding carries the stage it has actually earned, and the engine is the thing that promotes it.
- Possible1 / 3
A detection rule matched. The finding is recorded with its raw request, the response and the baseline it was compared against — and it stops here until something independent agrees.
- Confirmed2 / 3
A second, different kind of evidence agreed: a real browser dialog, a timing differential that survives a median-and-standard-deviation baseline, or an out-of-band callback from the target itself.
- Exploited3 / 3
The engine went further and demonstrated impact — extracted data through a confirmed injection point, or reached a resource the access-control check said it should not.
Refuted
The confirmation pass actively disagreed. The finding is kept with its evidence rather than silently dropped, so you can see what the engine decided and why.
A DOM XSS finding is only Confirmed when a real alert() fires in a Chromium page the scanner is driving.
SelfSec DAST capabilities
Explore the depth behind the workflow
Scan the capability map here, then open the technical page for implementation detail and representative output.
Crawl
A crawler that renders like a human, not a bot
Explore categoryAuth
Two-factor logins are a configuration, not a blocker
Explore categoryAttack
An attack engine that thinks, not a checklist
Explore categoryConfirm
The stage a finding earns, not the one it claims
Explore categoryOOB · OAST
Out-of-band proof that never has to leave your network
Explore categoryWAF evasion
A firewall is an obstacle, not a verdict
Explore categoryMobile
Android apps feed the same engine, not a second product
Explore categoryHelperAI
AI that plans the attack, the engine that confirms it
Explore categoryReporting
Triage and reporting that ships
Explore categorySelf-host
Core scan processing stays on your machine
Explore categoryControl by architecture
Know where every security-sensitive flow goes
Targets, responses and findings remain with the scanner. Activation is narrowly scoped, and device diagnostics and out-of-band reporting stay off unless you turn them on.
Read the Privacy Policy
Your infrastructure
LOCAL CORE · EXPLICIT REMOTE FLOWS
Scan processing and findings stay local
Account activation is narrowly scoped
Optional telemetry stays off unless you turn it on
Be first to run SelfSec DAST
Join the launch list for availability, deployment guidance and the first production-ready release.