Standard Perimeter Scans are available to all accounts (including Free accounts). They execute rapid external reconnaissance within 60 seconds: passive DNS surface discovery, TLS/SSL certificate hygiene validation, HTTP defense-in-depth header inspection (HSTS, CSP, X-Frame-Options), and exposed administrative port identification.

Deep Scans are reserved for PRO and ENTERPRISE accounts with verified domain ownership. Deep scans perform exhaustive multi-point vulnerability assessment, automated OWASP Top 10 surface fuzzing, sub-path directory exposure tests, weaponized CVE matching across 1,740 catalogs, and sovereign threat telemetry correlation.

KuroSec utilizes an asynchronous, non-blocking scan execution queue with intelligent concurrency controls to prevent rate-limit penalties and ensure security probes are never flagged as denial-of-service traffic by upstream firewalls or Cloudflare.

When you initiate an assessment, the scan job is registered in our execution queue and progresses through automated stages:

• PREPARING: Target URL canonicalization, DNS record lookup, and tenant quota reservation.
• ACTIVE_ASSESSMENT: Non-destructive TLS, header, port, and security posture probes.
• REPORT_GENERATION: Posture scoring, threat synthesis, and auditor dossier compilation.

Yes, 100% safe. KuroSec perimeter probes are engineered specifically for continuous, non-disruptive external monitoring. Probes do not perform intrusive payload injections, SQL drop statements, buffer overflows, or denial-of-service stress testing.

All outbound probes originate from documented static IP ranges, adhere strictly to Responsible Security Disclosure guidelines, and respect web application firewall (WAF) rate limits.

To adhere to Australian Cyber Security Centre (ACSC) ethical guidelines, international anti-abuse regulations, and cloud provider acceptable use policies, in-depth vulnerability testing requires cryptographic proof that you own or administratively manage the target perimeter.

Domain verification prevents unauthorized actors from conducting unsolicited deep testing against third-party targets, and unlocks continuous automated fleet monitoring for your assets.

Navigate to the Domain Ownership Verification tab in the sidebar:

1. Enter your root domain (e.g. yourcompany.com) to generate your cryptographic token (e.g. secscan-verify=cammio-token-uuid).
2. Option A (DNS TXT): In your DNS provider (Cloudflare, AWS Route 53, GoDaddy), add a TXT record at root @ with the token value.
3. Option B (Meta Tag / Well-Known): Place <meta name="secscan-verify" content="your-token"> in your site's <head> or host the token at /.well-known/secscan-verify.txt.
4. Click Verify Domain. Verification is confirmed instantaneously.

Code SAST Studio accepts ZIP archives (up to 100MB) or raw code snippets. The AST static analysis and backdoor detection engine natively audits:

• Languages: Python (.py), JavaScript & TypeScript (.js, .ts, .jsx, .tsx), Go (.go), Rust (.rs), Java (.java), PHP (.php), C/C++ (.c, .cpp), and Ruby (.rb).
• Infrastructure as Code (IaC): Dockerfiles, Kubernetes YAML manifests, and Terraform (.tf).
• Vulnerability Classes: Command injection, SQL string interpolation, insecure deserialization, SSRF, hardcoded API secrets, backdoor reverse shells, and cryptomining payloads.

Absolutely not. KuroSec operates under strict Zero-Storage In-Memory Confidentiality (SEC-09):

• Source files and archives are extracted strictly into ephemeral, RAM-backed memory sandboxes.
• Once the static AST analysis is complete, all archive bytes and temporary buffers are cryptographically overwritten and purged from disk.
• Your intellectual property is never persisted in databases, never shared with third parties, and never used to train artificial intelligence models.

Traditional static analysis tools often flood security engineers with dozens of duplicate alerts for the same underlying coding issue (e.g. 50 instances of string concatenation in database query helpers).

KuroSec uses Smart Collation and Semantic Grouping: findings originating from the same root vulnerability pattern within a module are unified into a single actionable card with aggregated file/line references and consolidated remediation guidance.

The Fleet Posture Score provides an executive cyber hygiene benchmark (0 to 100) across all monitored targets in your organization:

• Grade A (90–100): Hardened perimeter, modern TLS 1.3, strict HSTS/CSP headers, zero critical/high exposures.
• Grade B (80–89): Good security posture with minor header optimizations or low-severity recommendations.
• Grade C (70–79): Moderate risk; missing key defensive headers or outdated software components.
• Grade D (60–69): Elevated risk; high-severity findings or exposed administrative endpoints detected.
• Grade F (<60): Critical exposure; active weaponized CVEs or unauthenticated remote access points identified.

In the Monitored Targets (Fleet) table, click the calendar icon next to any verified domain to configure automated assessment cadence:

• Daily Continuous Assessment: Scans execute automatically once every 24 hours during off-peak windows (02:00–04:00 local time).
• Weekly Security Audit: Scans execute every 7 days on your designated audit day.
• If a new high-severity CVE matching your technology stack is published, automated telemetry alerts highlight the affected assets on your dashboard.

KuroSec incorporates curated cyber threat telemetry tailored for Australian, UK, and allied defense infrastructure:

• ACSC (Australian Cyber Security Centre): Sovereign advisories and ASD Essentials (ACSC) compliance baselines (superseding the legacy Essential Eight).
• CISA KEV (Known Exploited Vulnerabilities): Real-time catalog of actively weaponized exploits observed in the wild.
• NCSC (UK National Cyber Security Centre): Critical infrastructure early-warning threat feeds.

Yes. All registered users can explore and filter the catalog via the Threat Catalog tab in the sidebar. Professional and Enterprise subscribers can also query the feed programmatically via the REST endpoint GET /threats/catalog?q={keyword}&page=1 to enrich internal SIEM, SOAR, or vulnerability management workflows.

Agency and Enterprise subscribers can configure complete white-label reporting in Settings → White-Label & Logo:

• Upload your organization's PNG or SVG insignia.
• Configure custom primary brand accent color and dark cover page tint.
• Specify your Lead Auditor name, firm contact email, and corporate website.
• All subsequent PDF reports are generated with your custom masthead, typography, and color palette with zero default vendor watermarks.

The Report button in the Monitored Target Fleet table becomes active immediately after the initial scan completes for that target domain. If you recently added a domain and have not yet initiated or scheduled its first assessment, the button remains disabled until an assessment report has been generated.

Developer REST API access and interactive OpenAPI documentation (/docs, /redoc, and /openapi.json) are strictly reserved for Professional and Enterprise accounts.

API access allows engineering teams to programmatically enqueue web perimeter scans, trigger CI/CD code audits, query fleet posture metrics, and download executive PDF reports directly into build runners or internal portals.

In your GitHub Actions or GitLab CI pipeline, submit your repository bundle via POST /scans/code/jobs, poll until status is completed, and parse critical_count and high_count from the JSON payload.

If critical_count > 0 or high_count > 0, return a non-zero exit code (exit 1) to block merge approval. Full copy-pasteable CI/CD workflows are provided in the API & Docs tab.

Each subscription tier includes a monthly scan quota allocated on your billing anniversary date (e.g. 15 scans/month for Free, 100 scans/month for Professional).

To prevent platform gaming through account deletion and immediate re-registration, KuroSec enforces Anti-Abuse Quota Preservation (SEC-14):

• When an account is deleted, personal data is purged, but your remaining scan balance and monthly cycle date are cryptographically preserved in an anti-abuse registry.
• If the same email address re-registers within the active cycle, the remaining quota is restored until your legitimate anniversary rollover date.

KuroSec provides real-time, shields.io-compatible vector SVG posture badges that can be embedded into GitHub repositories, developer documentation, or corporate trust portals to showcase verified cyber hygiene.

Badge Endpoint Format:

https://kurosec.app/badges/{domain}/posture.svg

Markdown Embed:

![KuroSec Posture](https://kurosec.app/badges/yourcompany.com/posture.svg)

HTML Embed:

<img src="https://kurosec.app/badges/yourcompany.com/posture.svg" alt="Security Posture Rating" height="20">

Badges dynamically reflect the target's latest assessed letter grade (A: Teal #2BB3A3, B: Slate Blue #0284C7, C: Amber #D97706, D/F: Crimson #DC2626) with automated 60-second CDN caching for real-time responsiveness.

Navigate to Alerting & Webhooks in the sidebar to configure outbound security notifications:

1. Select Channel Type: Choose Google Chat Webhook, Slack Incoming Webhook, Microsoft Teams (Connector / Power Automate), or Generic SIEM / SOAR HTTP POST.
2. Configure Webhook URL: Paste the destination endpoint provided by your collaboration platform or security operations ingestion service.
3. Select Event Triggers:
   • critical_high_spike: Fires immediately when an assessment discovers critical or high severity vulnerabilities.
   • score_drop: Fires when an asset's cyber hygiene score drops below baseline threshold.
   • scan_completed: Dispatches an executive assessment summary whenever an automated scheduled scan finishes.
4. HMAC-SHA256 Signing Secret: Set an optional private signing key. KuroSec attaches a cryptographic X-KuroSec-Signature-256 header to every outbound POST payload for SIEM authenticity verification.

KuroSec maintains intentional architectural separation between Perimeter Attack Surface Monitoring and Source Code SAST:

• Perimeter Attack Surface monitors live, production-facing assets continuously over time (DNS records, SSL/TLS expiry, administrative port exposures, WAF defenses, and external web application security). These scans contribute directly to your organization's continuous posture score and SLA compliance.
• Source Code Security performs on-demand, point-in-time audits of repository archives, pull request branches, or script snippets.
• By maintaining decoupled scan histories and isolated score models, engineering teams can freely audit experimental repositories, third-party libraries, or sandbox code without skewing production perimeter compliance ratings.

Yes. In Code SAST Studio, switch to the Git Repository Audit tab and supply your repository HTTPS clone URL (e.g. https://github.com/org/repo.git). You can specify a custom branch and an optional Personal Access Token (PAT) for private repositories.

Enterprise SSRF & Sandbox Protection:

• Clone operations are executed within isolated, ephemeral container sandboxes using --depth 1 --single-branch to limit resource utilization.
• Strict Anti-SSRF egress guards resolve the remote host and automatically block loopback addresses (127.0.0.1), private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), cloud metadata endpoints (169.254.169.254), and non-standard network protocols.
• Access tokens and credentials are masked from logs and audit trails, and cloned files are shredded from memory immediately after AST parsing completes.

Professional, Agency, and Enterprise subscribers can manage personal credentials directly within the API & Docs portal:

1. Click Generate New API Key to issue a high-entropy secret token formatted as sec_live_....
2. Copy the token and save it to your CI/CD repository secrets (e.g. SECSCAN_API_KEY in GitHub Actions).
3. Pass the key in the HTTP request header: Authorization: Bearer sec_live_....
4. Key Lifecycle & Revocation: If a key is compromised, click Rotate Key to generate a fresh token instantly, or Revoke Key to immediately terminate all active API sessions associated with that token.

Every completed assessment generates a cryptographically signed public share token accessible via the Share Report link:

https://kurosec.app/scans/shared/{share_token}

Client & Auditor Access:

• Recipients can interactively review finding details, severity distributions, and remediation guidance without creating an account or logging in.
• Shared views are strictly read-only: external reviewers cannot modify targets, initiate scans, view your scan history, or access account billing settings.