AUTHORIZED WEBSITE SECURITY
Find vulnerabilities before attackers do.
Scan websites you are authorized to test, uncover observed security risks, and review evidence you can act on. The live assessment is a read-only LIGHT scan.
The AI analyst is not enabled. A finished scan is not a certification.
https://app.example.test
01
Security weaknesses can remain unnoticed until someone else finds them in production.
02
Raw scanner output is hard to read when every missing header looks equally urgent.
03
Without evidence and a clear status, teams spend time arguing about what was actually observed.
Labels match this build. Unavailable items are visible so they are not mistaken for live product.
A read-only LIGHT crawl requests pages with GET and HEAD inside an approved scope.
Deterministic checks record missing headers, cookie flags, TLS details, and exposed debug text.
Script URLs can show a library name and version. A filename is not treated as a confirmed CVE.
The analyst is switched off. Findings are not written or confirmed by a model.
Findings keep severity, validation state, and a review workflow inside the workspace.
A finished scan exports JSON, HTML, or PDF with coverage, limitations, and redacted evidence.
The scanner does not submit login forms, store session cookies for replay, or test as a signed-in user.
Schedules and webhooks are not available. Each scan is started by a person.
Step 1
Register a website you own or are authorized to test.
Step 2
Confirm control of the host and approve schemes, ports, paths, and rate limits.
Step 3
Automated checks examine the site only inside that approved LIGHT scope.
Step 4
Open findings, read the redacted evidence, and track the review status.
UNAVAILABLE IN THIS BUILD
The product direction is to explain technical findings in plain language. That analyst is switched off. Live findings come from deterministic checks, and evidence is not sent to a model.
Illustrative sample. Not a live AI response.
Medium · this check is live when a scan observes the header is absent
Sample explanation: a document response did not include Content-Security-Policy. The scanner records that absence. It does not claim the page is free of other issues.
Sample fix: send a policy such as default-src 'self' and review it before treating the header as complete protection.
Illustrative demo. These numbers are sample data, not a scan of a customer site.
Security overview
12
Sample findings
3
Sample assets
4
Sample scans
2
Awaiting retest
| Check | Finding | Severity | Status |
|---|---|---|---|
| HDR-002 | Content-Security-Policy absent | Medium | Open |
| CK-002 | Session cookie missing HttpOnly | Medium | Open |
| TLS-003 | Certificate not trusted | Medium | In review |
| LEAK-007 | Debug comment observed | Low | Open |
Scanning is limited to authorized assets and a controlled LIGHT profile. This page does not claim a certification or a compliance attestation.
A target stays unverified until a one-time token is proven. Development fixtures are the only automatic exception, and production does not use it.
Each scan freezes schemes, hosts, ports, paths, and rate limits. Redirects and DNS answers are checked again before a connection.
A finding is stored only when a check observed it. Untested checks stay not tested. They are not marked as passed.
Workflow status is separate from the automated result. The product does not confirm an issue because a model said so.
See the header, cookie, and leak issues a LIGHT scan actually observed before the next release.
Keep authorization, scope, evidence, and audit history attached to every scan.
Export a report that lists what was tested, what was not tested, and what was found.
Separate workspaces so one team cannot read another team's targets or reports.
Kujira Security is an authorization-gated website assessment product. The live mode is a read-only LIGHT scan of a host you verify and approve.
After ownership is verified and a scope is approved, the scanner fetches pages with GET and HEAD. Deterministic checks then run on those observations. It does not submit forms or ship an exploit engine.
Each finding names the check, the observed evidence, and a remediation note. A passed check means that one check ran and did not see its issue. It does not mean the site is secure.
No. A scan runs only against a verified host with an unexpired grant. Private addresses, metadata endpoints, and hosts outside the grant are rejected.
Not in this build. The AI analyst is disabled. Findings come from deterministic checks, and scan evidence is not sent to a model.
Yes. A completed scan can export JSON, HTML, and PDF. The file includes coverage and redacted evidence. The export is not a certification.
Take the first step toward a more secure website. Start with a host you are allowed to test.
Kujira Security