Customer-facing asset inventory
Organize verified public domains and subdomains inside the current Clerk organization boundary.
For SaaS security teams
Keep external findings in the same operating rhythm as engineering
Verify customer-facing scope, schedule authorized assessments, and give security and engineering one bounded record of findings, ownership, and remediation.
Three assets free for 14 days. Ownership verification and explicit authorization are required before scanning.
Exact authorized scope
Ownership proof and policy approval are bound to each asset before it becomes scan eligible.
Shared finding lifecycle
Open, acknowledged, resolved, accepted-risk, and disputed states keep remediation decisions visible.
Repeatable evidence
Deduplicated findings, scan history, reports, and notifications support an ongoing workflow.
Operating workflow
From explicit scope to a maintained finding record
The product keeps verification, authorization, execution, and remediation as separate decisions.
- 1
Map public application scope
Import eligible domains, verify control at the appropriate apex, and keep authorization exact to each target.
- 2
Choose the approved profile
Review supported checks, exclusions, quotas, and safety controls before scheduling or queueing work.
- 3
Route remediation
Prioritize trusted findings, record decisions, verify changes with a new run, and share bounded reports.
Product fit
A focused external vulnerability workflow
Scheduled external checks
Apply entitled daily or weekly UTC schedules without silently launching an immediate scan.
Finding ownership and history
Track status, notes, observations, scan relationships, and immutable audit events.
Evidence-oriented reports
Generate scoped reports that reflect trusted results without claiming compliance or complete coverage.
Know where the workflow fits
A clear boundary makes the automated results easier to use and explain.
Useful when
- Security and engineering share responsibility for public application exposure.
- The team wants repeated, authorized observations rather than occasional spreadsheet snapshots.
- Finding status and remediation evidence need to survive across scan runs.
Plan separately for
- Human-led penetration testing and business-logic assessment.
- Internal, cloud-control-plane, source-code, mobile, and endpoint coverage not represented by the selected external profile.
- Compliance certification, legal assurance, or a guarantee that an application is vulnerability-free.
Start with a scope your team can own
Start with the public assets your team owns, then expand only when verification, authorization, and operating ownership are clear.
Your first scan is one verified domain away
Three assets free for 14 days. No card required.
Start free