Jenis imbasan

Pasif

Available on every tier. A passive scan never sends crafted attack input; it fetches the URL like a normal browser and checks shipped responses, client assets, BaaS exposure, DNS, and public security posture against 250+ vulnerability classes.

Kerana ia read-only, pasif boleh berjalan terhadap mana-mana URL — tiada pengesahan domain, tiada attestasi. Pertukarannya ialah kedalaman: pasif terlepas semua perkara yang memerlukan penghantaran input untuk ditemui.

Apa yang ditangkap pasif

• Header keselamatan hilang (HSTS, CSP, frame-options, dll.).
• Atribut cookie tidak selamat (tiada Secure / HttpOnly / SameSite).
• Konfigurasi TLS lemah, sijil tamat tempoh, HSTS preload hilang.
• Rahsia dalam JS bundle (kunci service Supabase, kunci AWS, Stripe sk_, dll.).
• Source map, endpoint debug, spesifikasi OpenAPI, introspeksi GraphQL yang terdedah.
• Supabase RLS terbuka / aturan Firebase / salah konfigurasi Clerk.
• DNS (subdomain takeover, SPF/DKIM/DMARC hilang).
• Senarai threat-intel (Spamhaus, URLhaus).
• Versi framework lapuk dengan CVE yang diketahui.

Aktif Hobby+

Active scans perform bounded verification against verified domains you have explicitly authorized. They are available on the Hobby plan and higher tiers (Pro, Unlimited) and are designed to confirm risky behavior without publishing the underlying probe recipes.

Mengapa kami mengehadkannya: aliran attestasi

Probe aktif secara teori boleh menjejaskan production — respons perlahan, lonjakan ralat, data sampah dalam stor ujian. Kami memerlukan anda untuk:

1. Sahkan domain melalui DNS TXT atau fail HTTP (Account → Domains).
2. Attest autorisasi — satu pengesahan pada masa mula imbasan yang mengatakan anda mempunyai kebenaran. Dicop server dengan IP, user-agent, dan timestamp anda; ditulis ke audit_logs.

For scheduled re-scans and API/MCP active starts, domain authorization is recorded from Dashboard → Domains and can be revoked at any time. Automated active scans use the authorized safety level for that domain.

Repositori GitHub Pro+

Repo scans skip deployed URL testing and review source through the FixVibe GitHub App or your OAuth connection. They report high-confidence code, dependency, and repository-security risks without storing your source code.

Imbasan repo tidak pernah menulis ke repo anda dan tidak pernah menyimpan source code — hanya bukti dapatan disimpan. Kuota: bucket scansPerMonth yang sama seperti imbasan URL.

Picu melalui API

curl -X POST https://fixvibe.app/api/v1/scans \
  -H "Authorization: Bearer fxv_..." \
  -H "content-type: application/json" \
  -d '{"target":"https://staging.example.com"}'

REST API and MCP can start passive scans, and can start active scans for verified domains that have been explicitly authorized in Dashboard → Domains. Full reference: /docs/api.

Imbasan sekali jalan anonim

Halaman utama membenarkan pelawat yang belum mendaftar menjalankan satu imbasan pasif bagi setiap sesi browser. Imbasan ini tamat tempoh 24 jam selepas dicipta dan boleh dipindahkan ke akaun sebenar dengan mendaftar sebelum tamat tempoh — callback auth secara automatik melampirkan imbasan anonim kepada org baharu.