How does SuperClue scanning work?
SuperClue scans websites you have verified with up to 350 DAST modules, and scans code with a pattern-based SAST engine or an AI code review. You pay in credits per module or per scan. The answers below cover what each scan checks, what it returns and what it costs.
What does the SuperClue website scanner check?
It runs up to 350 DAST modules against a URL: 139 security tests and 211 checks mapped to compliance framework controls. You choose which modules run, from a single category up to the full catalogue. Each module has a 90 second timeout, so one slow check cannot stall the scan.
Do I need to own the domain I scan?
Yes. You verify the domain in your account and accept the scan authorisation terms before a website scan runs. The scanner identifies itself in its request headers, so your team can recognise it in server logs.
What does a scan return for each module?
Each module ends as completed, not applicable or requires access. 245 of the 350 modules cover areas where part of the answer sits inside your organisation, so they can end as requires access with a note on the evidence you need. You can export results as PDF, JSON, CSV, TXT, XML or HTML.
How much does a website scan cost?
The default price is 0.15 credits per module, so a full 350-module scan costs 52.5 credits. Deep-scan add-ons are billed separately, for example 15 credits for a Nuclei scan and 30 credits for a full deep pentest.
What is the difference between basic SAST and AI code review?
Basic SAST matches code against 10 pattern-based rule groups, such as SQL injection, cross-site scripting and hard-coded credentials, and costs 9.52 credits per scan. AI code review connects to a GitHub, GitLab.com, Bitbucket or Azure DevOps repository and reviews up to 80 files of up to 300 KB each, in 31 languages. It costs 25 credits per repository and 10 credits per pull request.
Is Nuclei part of every scan?
No. Nuclei is an optional deep-scan add-on that uses the open-source Nuclei engine and its community template library. It runs only when the Nuclei engine is available on the scanning server, and it is billed separately at 15 credits.
Does a CI/CD scan run the full scanner?
No. A CI/CD scan runs the 10-rule basic SAST on code you send, or a basic check of a URL: six security headers, the Server banner, HTTPS and the TRACE method. It does not run the 350-module engine. Each CI/CD scan costs 9.52 credits.
Verify a domain and run your first scan.
Request access