Sectora Documentation

Everything you need to scan, triage, fix, and prevent vulnerabilities — across web apps, source code, dependencies, secrets, APIs, and edge protection.

New here?

Start with the Quick Start — 5-minute path from sign-up to first triaged finding.

Scanning

DAST

Web application security testing. Crawls + exploits like an attacker would.

SAST

Source code analysis. Semgrep + Sectora's type-aware Go engine + AI Smart Triage.

SCA

Dependency vulnerabilities. NVD + GHSA + KEV + supply-chain signals.

Secrets

Leaked credentials in code + git history. With live provider validation.

API Security

REST + GraphQL + gRPC + WebSocket testing. OpenAPI-driven.

AI Security

LLM prompt injection + MCP server scanning + agent sandbox checks.

ASM

Attack surface management. Discover assets you forgot about.

Threat Intel

ATT&CK techniques surfacing in your scan data + KEV tracking.

Workflow

Vulnerability Management

Finding lifecycle, AI Smart Triage, FP inheritance, verify-fix.

Risk Scoring

How findings are prioritised across signals.

Compliance + Reporting

PCI / HIPAA / SOC 2 / ISO 27001 / GDPR reports from scan data.

Scheduled Scans

Cron-driven recurring scans. Daily Quick / weekly Full.

PR Gates

Block insecure PRs at merge time.

Alerts

Slack / PagerDuty / email / webhook routing.

Policies

Custom rules: deny GPL, require SLA, auto-page Criticals, etc.

License Policies

Block GPL/AGPL introductions at PR time.

Shield (edge WAF)

Shield Overview

9-layer architecture from anomaly scoring to virtual patches.

Setup

DNS, certs, mode selection, first 24h.

Virtual Patching

One-click WAF rule from any finding. <30s deploy.

Schema Enforcement

OpenAPI-driven blocking. Mass-assignment killer.

Managed Rulesets

OWASP CRS + CVE signatures + AI/GraphQL/scraping protections.

Bot Detection

JA4 fingerprints + browser-API probes.

Anomaly Scoring

14-signal behavioural model.

Rate Limiting

Per-IP / per-endpoint / per-user budgets.

IP Access

Allow / deny by IP, CIDR, ASN, country.

Shield API

Programmatic management.

Account + admin

Authentication

Magic link, SSO, API keys, sessions, audit log.

Teams + Roles

RBAC, invites, RLS, SCIM, service accounts.

Integrations

GitHub / GitLab / Bitbucket / Jira / Linear / Slack / cloud providers.

API Reference

Every endpoint, request, response.

Notifications

In-app + email + Slack notification config.

Advanced

Authenticated DAST

4 strategies: form / OAuth2 / SAML / recorded.

Auto-Fix

AI-generated PR with the fix. Click + review + merge.

Exploit Chains

Multi-step attack flows the single-request scanner misses.

CVE Detection

Targeted scanning for specific CVE advisories.

Vibe Risk

Brand + reputation surface — leaked credentials in breach corpora, social attacks.

AI Integrations

Bring your own Anthropic / OpenAI / Gemini key.

AI Code Detection

Detect AI-generated code in your codebase.

Monitoring

Continuous monitoring vs scheduled scans.

MSP / Partners

Multi-tenant Sectora for managed-service providers.

Can't find what you need?

Email docs@sectora.io or open an issue at github.com/sectora/docs. We'll either find the page you need or write it.