How do SuperClue scans work?

The scanner has 350 modules, grouped into 49 categories in the scan screen. 139 are security tests (injection, headers, TLS, GraphQL, secrets, email security, attack surface and more). The other 211 map external checks to compliance framework controls.

• Each module has a 90-second time limit.
• The default price is 0.15 credits per module, so a full 350-module scan costs 52.5 credits.
• You can run every module or select only the ones you need.

To see how the scanner identifies itself to your servers, read how our scanner behaves.

SuperClue scans only domains you have verified. Choose one of three methods, using the token shown in the app:

• DNS: add a TXT record superclue-verify=<token>.
• HTML: add a meta tag named superclue-verify with the token to your homepage head.
• File: serve the token at /.well-known/superclue-verify.txt.

A domain that runs a SuperClue SOC agent with a heartbeat in the last 5 minutes also counts as verified. Private and internal addresses are always blocked.

Each module ends as completed, not applicable (nothing to assess on this target, for example no GraphQL endpoint) or requires access (it needs credentials, source code or internal evidence that a URL cannot give). 245 of the 350 modules sit in evidence-based categories, so "requires access" is a normal result for them.

Five add-ons go beyond the standard scan, each billed separately: a deep crawler, an active exploitation scan, a Nuclei scan, a full deep pentest and an agent-assisted scan. The Nuclei scan (15 credits) uses the open-source Nuclei engine and its community templates, when the engine is installed on the server. The full deep pentest costs 30 credits.

Basic SAST matches your code against 10 pattern-based rule groups: SQL injection, XSS, hard-coded credentials, command injection, code injection, path traversal, CSRF, insecure headers, insecure deserialisation and weak crypto. The rules are language-agnostic. A scan costs 9.52 credits. AI code review is a separate feature, covered in AI features.

Scan reports export as PDF, JSON, CSV, TXT, XML or HTML. AI code review results also export as SARIF.