Security Scan

Fetches the page and same-origin scripts, then runs OWASP-aligned checks: security headers, exposed secrets, CSRF, mixed content, cookie flags, and SRI.

POST/api/security-scansynchronous

Headers, SSL, risk score, exposed files

Request body

{
  "url": "https://example.com"
}

Response

{
  "scanId": "clxyz...",
  "riskScore": 72,
  "findings": [...],
  "headers": {...},
  "sslInfo": {...},
  "suggestions": [...],
  "aiSummary": "..."
}

Example

curl -X POST https://www.scanverra.com/api/security-scan \
  -H "X-API-Key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

How riskScore is computed

riskScore starts at 100 (higher = safer). Each finding deducts points based on severity — critical -30, high -20, medium -10, low-5 — capped per category (e.g. exposed secrets can drop the score at most 25 points, security headers at most 20). Grade bands: A+ ≥90, A ≥80, B ≥65, C ≥50, D ≥30, F <30. There is no built-in pass/fail gate — pick your own threshold when using it in a pipeline (see CI/CD Integration).

PreviousWebsite Audit Next Browser Test