llms.txt
# Decloak
> Decloak is an automated web security intelligence platform. A user submits a URL and receives a scored, graded report covering HTTP/TLS posture, page content, network behaviour, JavaScript vulnerabilities, tag managers, third-party domains, DNS/TLS/subdomain exposure, vibe-coded platform misconfigurations (Supabase, Lovable, Base44, Bubble, Next.js), and (on Enterprise) active security testing, tied together with an AI-written executive summary.
## What Decloak checks
Decloak runs 10 scan layers against a target website - the first 7 plus layer 10 run on every scan including the free tier (8 total), 2 more (layers 8 and 9) are paid-tier only:
1. **HTTP & Transport Analysis** - security headers, TLS configuration, cookie flags, and transport-level misconfigurations.
2. **Static HTML Analysis** - page markup, inline scripts, and asset extraction.
3. **Rendered Page & Network Traffic Analysis** - a real browser (via Playwright) renders the page and records every network request it makes.
4. **JavaScript Vulnerability Scanning** - detects known-vulnerable JavaScript libraries (via the Retire.js vulnerability database) and dangerous code patterns, with CVE IDs linked to NVD.
5. **Tag Manager Intelligence** - inspects Google Tag Manager and similar containers for what they load and where data flows.
6. **Third-Party Domain Intelligence** - maps every third-party domain a page talks to and flags known-malicious infrastructure.
7. **AI Executive Summary** - a large language model synthesizes the findings from layers 1-6 and 10 into a plain-English executive summary with remediation guidance.
8. **Active Security Testing (DAST)** - Enterprise only. Safe, non-destructive active probes: forced browsing, CORS misconfiguration checks, reflected-input canaries, authenticated scans behind a real login, and systematic API endpoint discovery (OpenAPI/Swagger, GraphQL introspection, WSDL, plus undocumented endpoints found via wordlist and page-JavaScript analysis) with light active testing on each. Scored as an independent Active Testing Score.
9. **DNS, TLS & Subdomain Discovery** - Starter and up. SPF/DMARC/DNSSEC/CAA records, certificate issuer/expiry/cipher strength, subdomain enumeration via common-name wordlist plus certificate transparency log lookups (crt.sh), subdomain takeover detection (dangling/hijackable CNAME records pointing at unclaimed third-party services like GitHub Pages, Heroku, or S3), and - for IP-address scan targets specifically - a passive connect-only probe of ~18 common non-web service ports (databases, remote access, file transfer, mail) plus a reverse DNS (PTR) lookup.
10. **Vibe-Coded Platform Security** - free tier included, runs on every scan. Fingerprints Supabase, Lovable, Base44, Bubble, and Next.js, then checks for the misconfigurations most commonly reported for that stack: publicly readable database tables via a leaked anon key, exposed Supabase service_role keys, Bubble Data API exposure, and known platform CVEs (e.g. the Next.js middleware authorization bypass, CVE-2025-29927).
11. **AI Pentesting** - Enterprise only, a second explicit opt-in nested under Active Testing. Sandboxed runs of sqlmap (SQL injection), dalfox (XSS), commix (OS command injection), nuclei (out-of-band SSRF/XXE confirmation, plus exposure/misconfiguration deepening), ffuf (hidden parameter discovery), and jwt_tool (JWT weak-secret cracking) attempt to actually confirm exploitability (not just flag a signal) against targets the scan already found - including API endpoints and single-page-app routes discovered in page JavaScript - producing proof-of-exploit evidence for confirmed findings. Reported with its own Pentest Score, and confirmed exploits are also folded into the overall security score once testing completes; a standalone pentest report is included.
12. **Expert Mode & Scan Profiles** - Enterprise only, a per-team setting. Named, reusable Scan Profiles control requests-per-second throttling, crawl depth/page limits, retries/backoff, custom User-Agent/headers/cookies, URL exclusions, per-check Active Testing control, and per-tool AI Pentesting control (including an Aggressive tier gated behind a separate liability confirmation). Applies automatically to scans started via the web app, scheduled runs, and the REST API/MCP server.
## OWASP Top 10 coverage checklist
Every report - free tier included - includes an explicit OWASP Top 10:2025 coverage checklist: all 10 categories, each marked confirmed (a finding maps to it), clean (the relevant checks ran and found nothing), or not tested (outside what external scanning can assess, e.g. Insecure Design or Logging & Alerting Failures, which need source access or internal configuration). Shown as its own section on the web report and its own appendix in every PDF.
## Tiers
- **Free** - single-page scan, no login required, results in about 15 seconds, produces a shareable public report link, includes vibe-coded platform security checks.
- **Starter (£29/mo)** - an AI agent crawls up to 50 pages of a site, decides what to check next, adds DNS/TLS/subdomain analysis, scheduled scans, per-finding remediation, and a Priority Remediation Plan (a ranked top-25 fix list with plain-English AI guidance, exportable as a PDF).
- **Pro (£79/mo)** - up to 200 pages, ISO 27001/SOC2/NIS2/DORA/LGPD/PCI DSS/NIST CSF/EU CRA compliance control mapping, remediation tracking, team accounts, API and MCP access, Slack and webhook integrations.
- **Enterprise (£99/mo)** - everything in Pro, plus Active Security Testing (DAST) including systematic API endpoint discovery and testing (REST/GraphQL/SOAP), AI Pentesting (sandboxed exploitation-confirmation testing), authenticated scan mode via a browser extension, Expert Mode & Scan Profiles for granular scan control, and standalone executive DAST/Pentest reports.
## Who uses it
- **Vibe coders & solo builders** - free instant checks for AI-built apps, including detection of common Supabase, Lovable, and Base44 misconfigurations (like a publicly readable database).
- **Small & growing businesses** - scheduled scans and DNS/TLS/subdomain monitoring without an enterprise scanner budget.
- **Compliance & security teams** - SOC2/ISO 27001/NIS2/DORA/LGPD/PCI DSS/NIST CSF/EU CRA evidence mapping plus Enterprise-tier active security testing.
- **Agencies & MSPs** - one dashboard across every client domain, with team seats and API/MCP access.
## Learn more
- How it works: https://decloak.dev/how-it-works
- Full feature list: https://decloak.dev/features
- Integrations (Slack, webhooks, API, MCP): https://decloak.dev/integrations
- Frequently asked questions: https://decloak.dev/faq
- For vibe coders & solo builders: https://decloak.dev/for-vibe-coders
- For small & growing businesses: https://decloak.dev/for-small-business
- For compliance & security teams: https://decloak.dev/for-compliance
- For agencies & MSPs: https://decloak.dev/for-agencies
- AI Pentesting (Enterprise): https://decloak.dev/ai-pentesting
- How Decloak compares with other security scanners: https://decloak.dev/alternatives
- Decloak vs Intruder: https://decloak.dev/alternatives/intruder
- Decloak vs AppCheck: https://decloak.dev/alternatives/appcheck
- Decloak vs Detectify: https://decloak.dev/alternatives/detectify
- Decloak vs Barrion: https://decloak.dev/alternatives/barrion
- Decloak vs Invicti (formerly Acunetix): https://decloak.dev/alternatives/invicti
- Decloak vs Aikido Security: https://decloak.dev/alternatives/aikido
- Decloak vs PortSwigger (Burp Suite): https://decloak.dev/alternatives/portswigger
- Decloak vs Astra Security: https://decloak.dev/alternatives/astra
- Decloak vs Pentest-Tools.com: https://decloak.dev/alternatives/pentest-tools
- Decloak vs Nanotesting: https://decloak.dev/alternatives/nanotesting
- Decloak vs Intrudify: https://decloak.dev/alternatives/intrudify
- Decloak vs Pentoma (SEWORKS): https://decloak.dev/alternatives/pentoma
- Decloak vs Aptori: https://decloak.dev/alternatives/aptori
- Decloak vs Offload Security: https://decloak.dev/alternatives/offload-security
- Full text of every public page in one file: https://decloak.dev/llms-full.txt
- API catalog and MCP server card: https://decloak.dev/.well-known/api-catalog
- The Decloak Journal (security news and platform updates): https://decloak.dev/journal
- Guides (practical, source-backed web app security guides): https://decloak.dev/guides
Decloak is operated by Sparrow Technology Ltd, a company registered in England and Wales.
