01
Target and permission
Add a website or API, verify control using DNS or a file, then authorize testing.
SECURITY CHECKS. ONE WORKSPACE.
Find weak spots in your website and API. Before your next release.
Add your target, verify ownership and configure checks in the dashboard. Scantelio checks configuration, user access and dependencies, with evidence, remediation guidance and targeted retests.
Start on Free·No repository upload to Scantelio
Websites & web appsAPIs & SaaSBackends for apps & botsStores & marketplacesCRM & ERP
01 / SET UP IN YOUR DASHBOARD
Start with a URL. Add depth as you go.
Your first external check needs no editor connection or source-code upload. For deeper scenarios, Scantelio shows which inputs are still missing.
02
Configure for your project
Choose an environment. Add OpenAPI, test accounts, fixtures and a dependency inventory where needed.
03
Run and review
Run a check available on your plan. See findings, evidence, remediation guidance and coverage limitations.
02 / COVERAGE
It works. But who can access it?
See what was tested, what was found and which scenarios remain outside the scope.
01
What is exposed
TLS, headers, CORS, exposed configuration and debug pages. Bounded reads within your scope.
External perimeter02
Who can access someone else’s data
Cross-account access, JWT and approved staging scenarios using known test fixtures.
Fixture-based checks03
Which versions are vulnerable
10 ecosystems, from npm and Python to Java, Go and .NET. Monitoring scoped to your project’s packages and exact versions.
10 ecosystems / CycloneDX03 / MORE THAN AN ISSUE LIST
Know what was found. Know what to do next.
Each finding includes evidence, context and remediation guidance. Investigate the issue, apply a fix and retest that specific scenario without starting a new full scan.
Explore a sample reportReports distinguish completed, skipped and inapplicable checks. A clean result is not a guarantee of complete security.
04 / AFTER THE FIRST SCAN
Keep shipping. Keep checking.
The value goes beyond one report. Add release checks, dependency monitoring and retests within your plan.
Checks in CI/CD
Get release-check results in your pipeline. An incomplete check is not presented as a pass.
Relevant Telegram alerts
New known vulnerabilities matched to your dependencies and affected versions, not the entire CVE catalog.
Verify the fix
Rerun a scenario after a code change and track the result. Schedules help keep checks consistent.
05 / PRICING
Start free. Build a checking routine.
Automated security checks for your product. Paid subscriptions are coming soon.
Catalog temporarily unavailable. Refresh this page.
Detailed limits and scan units
A product is one independent application. Its website, API and staging share the address limit; independent sites are separate products. Test accounts belong to the application being checked, while team members belong to your Scantelio workspace.
One full scan checks one environment. Production and staging are separate runs. An API operation is a method and path template, not an individual network request.
One concurrent run per product. Short checks: up to 100 requests / 3 minutes; targeted retests: up to 300 requests / 10 minutes. These are ceilings; the report identifies anything left unchecked.
Monthly quotas are shared by the workspace. Daily short checks are per product and UTC day. Exhausted quotas prevent new runs without surprise charges. Matching dependencies against vulnerability databases does not consume full scans.
The automated service does not include manual penetration testing, expert setup, human code fixes or security certification. The owner supplies credentials and test data.
A few answers before your first scan.
What do I need for my first check?+
A public website or API you control. Add its URL, verify ownership using DNS or a verification file, and authorize testing. External checks do not require source code or an AI editor.
What is needed for deeper API checks?+
Depending on the scenario: an API schema, test accounts with different permissions, known test objects and expected access rules. Active state-changing checks require staging and separate consent. Missing inputs are shown as coverage limitations.
Is this a manual penetration test?+
No. You configure the project in the dashboard; Scantelio executes automated checks. The subscription does not include a human penetration tester or security certification.
Does a clean report guarantee security?+
No. It means no issue was found in the completed scenarios. Skipped and inconclusive checks remain visible.
Can I use an AI assistant later?+
Yes. Connect an MCP-capable editor to the same project. Your existing permissions, plan limits and scan consent still apply.
In detail: required inputs, authentication and partial coverage
What we check. What we need from you.
Coverage depends on the selected profile, approved scenarios and available data. A completed scan is not a guarantee that all vulnerabilities were found.
What runs automatically
After address verification and your consent, scans check HTTPS/TLS, headers, CORS, exposed configuration, debug pages and a reviewed Nuclei pack: 40 full-profile rules and 9 short-profile rules. Declare each address’s stack to skip unrelated checks. An unknown-path control excludes SPA fallbacks. Bounded HTML discovery reads up to 3 pages in short scans and 10 in full scans; forms are inventoried, never automatically submitted. Full scans also execute approved GET/HEAD operations with concrete paths. Enable a schedule for recurring scans; dependency monitoring needs an inventory and an enabled service.
What the owner provides
Provide a website/API URL, file or DNS ownership proof, and scan consent. API checks need OpenAPI or concrete operations. Access checks need dedicated test accounts, roles, known fixture objects, unique markers and expected allow/deny outcomes. Dependencies need exact versions from npm package-lock, CycloneDX SBOM or manual input. Schema import alone neither approves requests nor proves business-logic coverage.
Which checks require staging
SQLi, XSS, active CVE checks, Mass Assignment and rate-limit diagnostics require a staging environment on Pro/Business and separate consent per scenario. Mutation checks need a test fixture and verifiable restoration. External checks and approved read scenarios may run in production. SQLi/XSS support query parameters, POST forms and selected nested JSON fields. XSS confirmation replays HTML in Chromium with response CSP and no subresources. The service does not automatically try every CVE.
What partial coverage means
Some checks ran, but others lack evidence: an expired session, missing scenario, WAF, unavailable target or exhausted budget. Skipped means not executed; inconclusive means an attempt gave no reliable conclusion; not applicable means the check does not fit the response or technology. Existing findings remain valid. No findings with incomplete coverage is not proof of security. Address the stated cause and rerun; review each scenario, not just the overall status.
Supported authentication
Bearer tokens, API keys in a header, cookies and JSON login with token extraction and configured refresh. Provide a session-check path and use Validate access. JWT checks support configured issuer/audience and trusted JWKS. Secrets are encrypted and never returned to the interface. GitHub OAuth signs you into Scantelio separately. Browser login with CAPTCHA/MFA and automatic browser crawling are not supported.
Available notifications
The inbox supports reading and archiving messages. External notifications use private Telegram bot messages after linking, subject to your plan. Preferences cover important findings, scan summaries, vulnerable dependencies, service updates and marketing. Dependency alerts apply only to your project's packages and affected versions; unknown versions do not produce confirmed Telegram alerts. No email notifications. Administrators can message selected customers or the eligible audience.
YOUR NEXT STEP
Give your project its first security check.
Add your website or API and start with an external check on Free. Add deeper scenarios when your inputs and plan are ready.
Add your project and get startedSee a sample report first