About
Defensive security tooling, built to be trusted
TasScan exists to give website owners, developers and businesses a clear, honest view of their public security posture — and the means to improve it.
Principles
Seven rules we build by
- 01
Authorized targets only
No scan beyond the free check runs until ownership is proven and an authorization record exists. The one exception, the free check, is a small fixed set of read-only requests to a public hostname you enter. At most 1 request per second, 20 requests and 60 seconds per check, one connection at a time.
- 02
Non-destructive by construction
Observational checks and safe proof techniques only. Enforced by the module contract and code review, not by policy alone.
- 03
Scanning does not run on application servers
In the production configuration, scanning never runs on the application servers: only isolated scanner workers with no database credentials open connections to targets. On the single-VM development and staging layout the workers run on the same host as the application, as separate processes without database credentials.
- 04
Tenant isolation is defence in depth
Application scoping plus database row-level security, with tests that try to break it.
- 05
Server-side security gate
Every scan request passes fourteen checks in the API before a job is queued; the UI is a usability layer.
- 06
Nothing is faked
Controls that are not implemented are disabled and labelled. Results shown to customers always come from a real check.
- 07
Replaceable parts
Every service boundary is an HTTP or queue contract, so components can be swapped without a rewrite.
Today
What the product does today
The current release delivers the public site and free check, registration with email verification and MFA, organizations with roles, asset verification, authorization records, the Quick, Standard, Deep and Custom scan profiles on isolated workers (which plan includes which profile is on the pricing page), the findings engine and score, PDF reports, uptime, certificate, DNS, security-header and defacement monitoring, and email, in-app and daily-digest notifications.
Scheduled scans and attack-surface discovery are available in the customer workspace. API tokens, signed webhooks, Slack, Microsoft Teams, PagerDuty, Jira and GitHub issue destinations, report branding, passkeys and the mobile approver app are available, and online payments are switched on when the platform enables billing. Standard scans are included in: Starter, Professional, Business, Enterprise. Deep scans are included in: Professional, Business, Enterprise.
Authenticated scanning (testing behind a login) is not available today. SMS alerts are available only on plans that include them and only when the platform operator connects an SMS provider; they are not configured by default. Single sign-on (SAML / OIDC) is not available today. Anything not shipped is shown as disabled in the product, and the disabled state comes from the platform, not from this page.
Let's talk
Start with a free external check.
Run the free security check now. An account lets you verify your domain and unlock the full report.
TasScan is invite-only right now. Request an invite and we will be in touch.