How it works
Process
From a domain you own to a prioritized PDF. Each stage below shows what the scanner really does and the limits it runs under.
01Verify
Prove the domain is yours
Nothing touches your site until you prove you control it. Add a DNS TXT record or upload one small file to your web root, and we check it from our side. Only domains are accepted, never bare IP addresses.
- DNS
TXT auditly-verify=<token> - File
/auditly-verify.txt - TokenValid for 24 hours
- HelpWe detect your DNS provider and tell you where the record goes
- RenewalOwnership is checked again every 30 days
02Pay
Payment clears before a single request
Checkout runs on Stripe, so Auditly never sees your card. The scan job is created only when Stripe's signed webhook confirms the payment: a closed tab, a declined card or a forged redirect never starts a scan.
- Price$29 USD, one-time, per scan
- ProcessorStripe Checkout
- Trigger
checkout.session.completed - CheckWebhook signature verified on our server
03Crawl
We map your site the way a browser sees it
A headless Chromium renders each page, so apps built with React, Vue or Next are crawled after their JavaScript runs, not as empty HTML shells. The crawl stays on your origin and inside a fixed budget, so it never behaves like a flood.
- ScopeSame origin only, links one level deep
- BudgetUp to 20 pages and 150 requests
- Pace0.3 s between requests, 10 s timeout
- Identity
User-Agent: Auditly/2.0
04Check
18 check modules, one after another
Each module looks at one attack surface. Most only read what your site already serves. The active ones send harmless probes and never change data: injection tests use GET parameters and skip forms, and the Supabase and Firebase probes only read.
- Passive8 modules: headers, TLS, cookies, CDN, secrets in JS, source maps, libraries, email
- Active8 modules: CORS, methods, host header, exposed files, injection, redirects, Supabase, Firebase
- Opt-in2 modules: login and general rate limiting, off by default
05Report
Findings ranked by real-world risk
Any finding that cites a CVE is checked against CISA's catalog of vulnerabilities exploited in the wild and FIRST's EPSS score, so what attackers use today rises to the top. Only the CVE ID leaves our server, never anything about your site.
- KEVKnown exploited, per CISA: fix first
- EPSSProbability of exploitation in the next 30 days
- LiveWatch each stage stream in while the scan runs
- DeliveryPDF by email and in your dashboard
What the scanner never does
An authorized scan should be safe for the site it audits. These limits are built into the code, not settings someone can forget.
- Scan an unverified domain
No ownership proof, no full scan. The free preview reads at most 5 pages and never turns on backend or login probes.
- Submit your forms
POST forms are skipped on purpose: submitting them could create accounts, send emails or post content.
- Write or delete data
Backend probes for Supabase and Firebase only read, exactly what an anonymous visitor could already do.
- Flood your server
A hard budget of 150 requests with a pause between each one. Load and login tests run only if you opt in.
- Hide who we are
Every request identifies itself as Auditly, from one real IP. No spoofing, no proxies, no evasion.
- Share your site's data
Only public CVE IDs go to the threat feeds. Findings stay between you and the report.
Start with step one
Verify your domain from the home page. It takes about two minutes.