What does the SuperClue website scanner check?
SuperClue runs dynamic application security testing (DAST) against a URL you have verified you own. The catalogue has 350 modules in 49 categories: 139 security tests and 211 checks mapped to compliance frameworks. You pick the modules, pay 0.15 credits for each, and get a status and evidence per module.
What are the 350 modules?
The modules split into two groups.
- 139 security tests: injection, cross-site scripting, authentication and session handling, TLS and security headers, exposed files, API and GraphQL endpoints, secrets in served JavaScript, email DNS records (SPF, DKIM, DMARC) and your external attack surface.
- 211 compliance-mapped checks: external checks tied to controls in frameworks such as CERT-In, SEBI CSCRF, RBI, PCI DSS and ISO 27001. See the frameworks on the compliance pages.
Every module sits in one of 49 categories, so you can see what each part of the scan covers. Each module has a 90 second timeout, which keeps one slow check from stalling the scan.
We removed 52 checks that could not assess anything from a URL, such as mobile app, IoT and cloud account checks. They are not offered and you are not billed for them.
What does a scan return?
Each module ends in one of three states. 245 of the 350 modules cover areas where part of the answer lives inside your organisation, so they can end as requires access instead of a pass or fail.
| Status | What it means |
|---|---|
| Completed | The module ran and reports a pass or a finding with severity and remediation advice. |
| Requires access | The control cannot be judged from outside. You get the external signals found and a prompt for the internal evidence an assessor will ask for. |
| Not applicable | The check does not apply to this target (for example, no GraphQL endpoint exists). |
You can export results as PDF, JSON, CSV, TXT, XML or HTML. Findings can also go to Jira or GitHub Issues through the integrations.
Why do I have to verify my domain first?
SuperClue only scans targets you control. Before the first scan you prove ownership with a DNS TXT record, an HTML meta tag or a file on the site. This stops anyone using the platform to probe a site they do not own.
How much does a scan cost?
You pay per module from your credit balance. Choose fewer modules and the scan costs less.
| Scope | Cost |
|---|---|
| One module | 0.15 credits |
| Full scan (all 350 modules) | 52.5 credits |
Deeper tests such as the authenticated crawler and active testing are billed separately. See deep pentest and pricing.
How does the scanner behave on my site?
The scanner identifies itself in every request and uses detection payloads, not destructive ones. Forms can still be submitted during testing, so scan a staging copy if that matters to you. Our scanner policy lists the headers it sends and how authorisation is logged.
Verify a domain and run your first scan.
Request access