Normalised and de-duplicated
Each observation is matched to a rule in our catalog and fingerprinted (asset, rule, URL, parameter) so re-scans update the same finding instead of creating duplicates.
Vulnerability Assessment
Authorized scans with findings you can act on
After you verify a domain and confirm authorization, TasScan runs scan profiles on dedicated scanner workers and turns raw observations into de-duplicated, scored findings with evidence and remediation.
TasScan is invite-only right now. Request an invite and we will be in touch.
Profiles
Scan profiles
Profiles bundle checks with limits. Which plans include each profile is read from the live plan catalog; an operator can also switch a profile off. Any profile your plan includes can run on a daily, weekly or monthly schedule for verified assets, through the same checks as a manual scan.
Quick
All plansDNS, TLS, HTTP (headers, cookies, redirects, mixed content, CORS origin-reflection check), exposure (well-known paths from a fixed list) and technology fingerprint.
Observational requests only; low intrusiveness.
Standard
Starter, Professional, Business, EnterpriseThe Quick checks plus WordPress checks. They run only when WordPress is detected: core, plugin and theme versions from public files, the XML-RPC banner, debug log and backup-copy paths, and directory listings.
Low intrusiveness; larger request budget and time limit than Quick.
Deep
Professional, Business, EnterpriseThe Standard checks plus a bounded same-site crawl, read-only safe web checks (open-redirect marker, reflected marker), TCP connect checks of a fixed port list on verified IP assets (optional read-only service identification when the authorization allows it) and API checks on API endpoint assets (OpenAPI document analysis, read-only scope probing of the definition you supply, CORS misconfiguration checks).
Medium intrusiveness; requires explicit confirmation and an authorization record.
Custom
EnterpriseA module selection you choose from the checks above, validated against your authorization record.
Only on plans that include it; every module still needs verified ownership.
API checks: analysis of the OpenAPI document you supply and read-only scope probing of the API definition you provide, plus CORS misconfiguration checks. Authenticated scanning (testing behind a login) is not available today. See pricing for what each plan includes.
Findings
From raw observation to a finding
How the number is calculated is explained, from the live rules, on the score methodology page.
Severity, explained
Default severity comes from the rule; it may be adjusted by at most one level for asset criticality and exposure. Measured data such as CVSS or CVE ids is shown separately and never silently changes the score. A version match is not proof of exploitability, and a fingerprint is the software we observed.
Evidence, redacted
Request and response excerpts are redacted for secrets in the worker and again server-side; cookie analysis keeps names and attributes only.
Lifecycle and audit
New → confirmed → in progress → resolved, plus risk accepted and false positive with a reason. Every change is recorded in the finding history.
Verify Fix
Re-run only the relevant module against the affected URL. The result is Resolved, Still vulnerable or Unable to verify — no guesswork.
Severity levels
Critical, High, Medium, Low and Informational. Informational findings are shown but never reduce your score.
Security score
How the score works
The score is a number from 0 to 100, recalculated after every scan and every monitoring change. Higher is better.
- It starts at 100 and subtracts weighted open findings: critical 20, high 9, medium 4 and low 1.5 points each, capped per category so one noisy area cannot zero the score.
- TLS, security-header and DNS configuration add their own small penalties, each with a ceiling.
- Monitoring adjusts the result by up to 3 points: minus 3 for unresolved downtime or change events, plus 3 once uptime monitoring has been enabled and healthy for 30 days.
- The organization score is the mean of the asset scores, weighted by each asset's criticality.
- Informational findings, resolved findings and findings marked false positive or risk accepted never reduce the score. Risk-accepted and false-positive findings stay visible with their reason.
Boundaries
Non-destructive by construction
These rules are enforced in code and by the module contract, not by policy alone. Automated scanning is not a penetration test.
What our scans do
- Observational requests (GET/HEAD/OPTIONS), TLS handshakes, DNS queries
- Well-known path probes from a fixed, curated list
- Header, cookie and content analysis; software fingerprinting from what the server shows
- Safe proof checks that are read-only (reflected marker, CORS origin reflection, open-redirect marker host). A reflected marker is not verification of cross-site scripting; a version match is not proof of exploitability
- Low-rate TCP connect checks of a fixed port list on verified IP assets, and, only if the authorization allows it, one read-only exchange per open port to identify the service
What they never do
- Credential guessing or brute force
- Form submissions that could create or modify data, file uploads
- Payloads that execute or persist, resource exhaustion
- Exploitation of RCE, deserialisation or SQL injection beyond a non-mutating detection heuristic
- Exceeding the platform ceilings: ≤ 5 requests/s, ≤ 2000 requests, ≤ 30 min, ≤ 2 MiB per response
Let's talk
Start with a free external check.
Run the free security check now. An account lets you verify your domain and unlock the full report.
TasScan is invite-only right now. Request an invite and we will be in touch.