Security

SekuScan has two components: an agent in your network and an engine operated by SekuriPy. The agent initiates all communication with the engine over HTTPS. No inbound port or firewall rule is required.

Architecture

Agent — your network

Runs Chromium and executes scan actions.
Rejects requests to targets that have not been verified.
Applies redaction before scan data leaves the agent.
Contains no check definitions and no scan-planning logic.

scope enforcement agent/scope.py
redaction agent/redaction.py

Engine — SekuScan infrastructure

Plans crawling and active checks.
Evaluates returned evidence.
Generates scan reports.
Never initiates a connection to the agent.

The engine is proprietary.

Example run flow

Agent · your network firewall Engine · SekuScan

POST /v1/runs200 · run token issued
POST /v1/runs/{id}/step200 · directive: navigate
⋮further steps, one connection
POST /v1/runs/{id}/step200 · directive: probe × 4
POST /v1/runs/{id}/complete200 · report ready

Data sent to the engine

Every observation the agent posts carries some of:

The URL requested and the URL reached, HTTP status, and page title.
Truncated samples of page text, HTML and inline script, each with the full length alongside it.
Links, form and control descriptions, script sources, subresource list and meta tags.
Per probe: the raw request and the raw response, response headers, a truncated body sample, the full body length and elapsed time.
Network events the browser saw: method, URL, status, request and response headers, and truncated request and response body samples.
Browser console messages.

Before anything leaves the agent, credentials and tokens are removed: authorization and cookie headers, JWT signatures, cloud and payment keys, and any pattern you configure. Cookie values are described by shape rather than sent, screenshots stay in the agent’s output directory, and anti-CSRF field values are submitted from the DOM without a round trip. The rules are agent/redaction.py.

Target verification

A host must be verified before SekuScan will scan it.

Publish TXT _sekuscan-verify.<host>, or serve /.well-known/sekuscan-verify.txt.
SekuScan records the account key, the host, the verification method and the verification time.

Vulnerability disclosure

Report vulnerabilities in SekuScan to security@sekuscan.com.
Machine-readable disclosure information is at /.well-known/security.txt.
Report suspected abuse to abuse@sekuscan.com.
For an actively exploited vulnerability in SekuScan, we submit the early warning through the EU Single Reporting Platform within 24 hours of becoming aware of it, under Article 14 of the Cyber Resilience Act.