Quick Start

Step 1 — Create your account

Sign up at sectora.io/auth/login. We don't use passwords — log in via magic link (one-time email link) or Google OAuth. New accounts come with a 14-day Pro trial that unlocks every scanner.

On first login you'll land on the dashboard. Two badges in the top-right matter:

• Trial banner — counts down from 14 days. Convert at any time via Settings → Billing.
• Plan chip — your current plan; gates which scanners/features you can run.

Step 2 — Verify a target

Sectora won't scan a target you can't prove you own. Verification takes ~30 seconds:

1. Settings → Domains → + Add domain
2. Enter your domain (e.g. example.com). Wildcards aren't needed — subdomains inherit verification.
3. Choose DNS TXT (recommended) or HTML file verification.
4. Publish the record, click Verify. Verified domains stay verified until you delete them.

For code scanning (SAST / SCA / Secrets), no domain verification is needed — connect a GitHub/GitLab/Bitbucket integration instead under Settings → Integrations.

Step 3 — Pick the right scanner

Quick guide to which scanner to use for what:

Most teams start with DAST + SCAon their staging environment, then add SAST + Secrets after seeing the initial pass. Each scanner catches what the others can't — don't pick one.

Step 4 — Run your first scan

DAST (web app scan)

1. Scans page → + New scan
2. Enter the target URL (must be a verified domain or subdomain)
3. Pick a profile:
   • Quick (2–5 min) — for CI gates and smoke checks. Critical-only checks.
   • OWASP Top 10 (10–30 min) — standard daily/weekly scan.
   • Full (30–90 min) — pre-release comprehensive scan including chain attacks, prototype pollution, source-map exposure.
4. (Optional) Configure auth — see Authenticated DAST. Public pages only? Skip this step.
5. (Optional) Adjust noise: Precise / Balanced / Comprehensive. Default is fine.
6. Click Start scan.

SAST (source code scan)

1. SAST page → + New scan
2. Pick a repo from the dropdown (only the ones you've connected appear)
3. Branch dropdown auto-populates from your repo's branches — typed values are also accepted
4. Mode: Hybrid (Semgrep + AI Smart Triage, recommended) or Semgrep only
5. Start scan. Larger repos take 1–3 minutes.

SCA (dependency scan)

1. Dependencies page → + New scan (or it auto-runs as part of every SAST scan)
2. SCA reads package.json / go.sum / requirements.txt / pom.xml from the repo
3. Findings are cross-referenced against NVD, GHSA, and CISA KEV catalogs in real time

Step 5 — Read your first findings

Scans complete in the background; you can leave the page. When done, click into the scan to see findings ranked by severity.

Anatomy of a finding

• Severity (Critical / High / Medium / Low / Info) — CVSS-based with our risk adjustment.
• AI Verdict — Smart Triage label (Real / Likely FP / FP confirmed) + confidence (0.0–1.0). Click to expand the AI's reasoning.
• Confirmed badge — shown when the same vulnerability was detected by BOTH SAST and DAST (highest signal — there's code AND it's exploitable).
• Location — file:line for code findings; URL + method + parameter for DAST findings.
• Code context — the matched snippet + ±20 lines, plus any sanitizer imports detected nearby.
• Fix suggestion — concrete fix grounded in the matched code, not generic OWASP boilerplate.

What to do with a finding

Step 6 — Set up CI/CD (the real win)

One-off scans are useful but don't scale. Sectora's real value is preventing regressions: every PR runs a DAST + SAST gate and blocks merges that introduce new High/Critical findings.

# .github/workflows/sectora.yml
name: Sectora Security Gate
on: pull_request

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Sectora SAST + DAST + SCA
        env:
          SECTORA_API_KEY: ${{ secrets.SECTORA_API_KEY }}
        run: |
          curl -sf -X POST https://api.sectora.io/api/v1/scans/pr-gate \
            -H "Authorization: Bearer $SECTORA_API_KEY" \
            -d '{"repo": "${{ github.repository }}", "pr": ${{ github.event.number }}}'

Full template + branch-protection wiring: PR Gates. Setup is ~10 minutes for one repo.

Step 7 — Connect a ticket tracker

Triage is much faster when findings auto-flow into your team's tracker. Settings → Integrations supports:

Once connected, enable Auto-create tickets on a scan (or in the schedule) and every finding above the threshold becomes a ticket with the full reproduction + AI verdict + fix suggestion attached.

Step 8 — Schedule recurring scans

Scans → Schedules → + New schedule. Cron syntax, multi-target, per-schedule profile + auth + alert policy. Common patterns:

• Daily Quick on every public origin — 5-min smoke catches regressions fast.
• Weekly Full on staging — broader coverage when slow scans don't matter.
• Daily SCA on every connected repo — catches new CVE advisories within hours.
• Daily Secrets on every connected repo — catches accidentally-committed keys.

Step 9 — Lock attackers out with Shield (optional, recommended)

Shield is Sectora's edge WAF. It runs at Cloudflare's edge in front of your origin, blocks attacks before they reach your code, and accepts one-click virtual-patch rules from any DAST/SAST finding.

Setup is ~10 minutes (DNS change + signing secret). See Shield Setup. After setup, virtual-patching becomes the fastest mitigation path: confirm a finding → click Virtual-patch → rule deploys globally in <30 seconds while engineering ships the real fix.

What's next

• DAST Scanning — comprehensive web app testing
• SAST Scanning — source code analysis with AI Smart Triage
• SCA + Supply Chain — dependency vulnerabilities
• Shield WAF — edge protection + virtual patching
• API Reference — automate everything
• PR Gates — block insecure PRs in CI