Getting started
Choose the right first scan for your platform.
Start with your target
Use a website address to inspect the public surface, or connect GitHub to examine source code and configuration. Only scan targets you own or are authorized to assess.
Choose your scope
Quick is a lighter first pass. Deep attempts broader eligible coverage. Automatic selects compatible checks; Choose lets you select security families. Access and compatibility still limit what can run.
Prepare a useful first analysis
Choose one platform and a precise target. A URL scan answers questions about the publicly reachable application. A repository scan also reads eligible source and configuration files. When both are available, connect the repository and explicitly provide its live URL; the deployed version may differ from the branch being read.
- Confirm ownership or written permission for the target.
- Check that the URL is the deployed application, not an editor link or private host.
- Select Quick or Deep and Automatic or Choose, then review the confirmation before launch.
Select the right modes
Quick provides a smaller initial pass. Deep attempts a broader set of eligible files and checks, but is not a guarantee that every control can run. Automatic uses compatible families, including AI security where applicable. Choose restricts the scan to the families you select; selecting a family does not supply missing access.
Example: a public website using an AI service may allow external endpoint checks. Without its source or authorized database access, the same scan cannot establish how prompts are constructed or which database policies protect private rows.
After the scan
Read completion and coverage before drawing conclusions from severity. Inspect the strongest evidence first, resolve confirmed high-impact issues and connect missing access where useful. If work stops, keep the partial report and use Continue only when the report offers it; do not assume a partial run checked the remaining items.
- Review completed, unavailable and not-run checks.
- Open findings and distinguish observed behavior from configuration review.
- Review corrections before approval and verify deployed behavior afterward.
Sources and further reading
These publications describe related practices and standards. They do not certify your platform or imply that Hackaiz executes every documented method.