Instead of producing one unexplained score, WebScan coordinates 15 defensive agents. Each one looks at a specific part of a web app's posture, then connects what it observed to a recommended change and a way to verify the fix.
The agents cover three broad areas:
•
Safer public delivery: transport, browser isolation, and visible session controls.
•
How the app protects people and data: authentication, authorization, input safety, client exposure, API and error behavior, and data privacy.
•
Security that stays maintainable: configuration hygiene, dependencies, supply chain, deployment, logging and recovery, plus storage and cryptography.
WebScan is for websites that you own or are explicitly authorized to review. A public URL is not permission, so the workflow includes an ownership acknowledgement and a domain-verification step before a review starts.
It is designed for defensive improvement and does not try to test credentials, bypass controls, or perform disruptive activity.
I am the author, and I would really value specific feedback:
1.
Does the 15-agent split make security work easier to prioritize?
2.
Which report detail helps you move from a finding to a real fix?
3.
How should a small project make its coverage and limitations easy to understand?
WebScan GitHub Repo
Top comments (0)