Platform
How the SkilledScan vulnerability scanner works
Discovery, check selection and testing are automated and run under a policy you can read. Every action is logged, and a candidate has to be reproduced before it can become a finding.
Pipeline
The six stages
- 1
Recon and OSINT
Map the target before touching it.
Domains, exposed services, technology stack, and public footprint are gathered first, so testing is aimed, not sprayed.
- 2
Enumeration
Find the endpoints, parameters, and surfaces worth testing.
Routes, parameters, and exposed functionality are catalogued into a testable attack surface.
- 3
Vulnerability analysis
Match the surface to likely weaknesses.
Detected technologies and versions are cross-referenced against known weaknesses and public advisories.
- 4
Active testing
Test the candidates under strict limits.
Checks run against approved targets only, rate-limited, non-destructive, and logged.
- 5
Verification
Every candidate finding is reproduced before it is reported.
Each candidate finding is reproduced and confirmed before it enters the report. Unconfirmed items stay in the raw log.
- 6
Reporting
Write it up for the people who have to act on it.
Findings are prioritized and written for leadership and for the developer who owns the fix.
The engine
What the engine does, and what it won't
The engine automates the repeatable parts of a security assessment: mapping the target, choosing checks and running them, all within policy.
The engine proposes checks that fit what it found. The checks themselves come from a fixed registry and run only when the policy gate approves them.
What it does
- Maps the target's technology and attack surface.
- Proposes checks that fit what it found, from a fixed registry of approved checks.
- Runs approved checks in isolated sandboxes, rate-limited and non-destructive.
- Keeps raw observations separate from confirmed findings.
What it will never do
- Test anything outside the approved scope.
- Run a check the policy gate has not approved.
- Remove rate limits or run destructive checks.
Only findings that are reproduced and confirmed reach your report. Everything else stays in the raw log for audit.
Guardrails
Limits that apply to every scan
- Only approved, in-scope targets are tested.
- Every check is rate-limited and non-destructive.
- Credential brute forcing stays off unless the agreed scope includes it.
- Every proposed, allowed, and blocked action is written to an audit log.
- If the planning model is unavailable, scanning continues on a fixed plan.
Verification
A finding has to be reproduced first
Real result: one authorized client scan, client details withheld
121
raw observations
5
reported findings
4.1% of raw observations were confirmed and reported.
Written permission before any scan
SkilledScan only scans targets you own or have written permission to test.
Next step
Send one URL to get started.
Email contact@skilledscan.com with the application or API you want scanned. Written authorization is confirmed before any scan runs.