# Sectora — Complete Platform Documentation > Sectora is an enterprise application security platform that unifies vulnerability scanning, real-time attack protection, and continuous monitoring. It follows a three-step security lifecycle: Detect, Protect, Monitor. --- ## DAST Scanning (Dynamic Application Security Testing) Automatically find vulnerabilities in running applications with comprehensive dynamic analysis. ### Features - **Automated Crawling & Discovery**: Intelligent crawler discovers all endpoints, forms, and interactive elements automatically. No manual configuration — just point and scan. - **OWASP Top 10 Coverage**: Comprehensive testing for SQL injection, XSS, CSRF, broken authentication, and all OWASP Top 10 categories. - **Real-Time Results**: Streaming results interface shows findings immediately as they are discovered. Start fixing issues while the scan continues. - **Smart Rate Limiting**: Configurable concurrency and request throttling ensure production applications stay responsive during scans. - **Authentication Support**: Full support for authenticated scanning with session tokens, cookies, and custom headers. Scan protected areas of your application. - **Nuclei Integration**: Powered by the Nuclei engine with 8,000+ vulnerability templates, regularly updated for the latest vulnerabilities. ### Benefits - Find vulnerabilities before attackers do with automated security testing - Reduce false positives with intelligent verification and context-aware analysis - Integrate into CI/CD pipelines for continuous security - Actionable remediation guidance for every vulnerability found - Detailed scan reports and compliance documentation for audit trails Learn more: https://sectora.io/features/dast --- ## SAST Code Analysis (Static Application Security Testing) Semgrep-powered static analysis across 30+ languages with AI false-positive filtering. ### Features - **30+ Language Support**: Analyze code in JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, C#, and more using Semgrep rules. - **AI False-Positive Filtering**: Machine learning models reduce noise by filtering out false positives automatically. - **SAST + DAST Cross-Correlation**: When both SAST and DAST scanners find the same vulnerability (e.g., CWE-89 in source code confirmed by SQL injection at runtime), it's marked as confirmed with highest priority. No other platform does this. - **GitHub Integration**: Check Runs with inline code annotations on pull requests. PR Security Gates block merges when critical findings are present. - **AI-Generated Code Fixes**: One-click remediation with AI-generated fixes and automatic PR creation. ### How Correlation Works - SAST finds CWE-89 (SQL Injection) in `auth.py:42` - DAST confirms SQL Injection on `POST /api/login` - Cross-scanner correlation marks the finding as **Confirmed** — both scanners agree - Correlated findings get highest priority for remediation Learn more: https://sectora.io/sast --- ## API Security Testing Comprehensive API security testing for REST, GraphQL, gRPC, and SOAP endpoints. ### Features - **OpenAPI/Swagger Integration**: Import OpenAPI 3.x or Swagger 2.0 specifications to auto-generate security tests. - **BOLA Detection**: Specialized testing for Broken Object Level Authorization (IDOR) and horizontal privilege escalation — the #1 API vulnerability. - **Injection Testing**: SQL injection, NoSQL injection, command injection, and other injection attacks across all API endpoints. - **Authentication Bypass**: Detect weak authentication, JWT vulnerabilities, session management issues, and API key exposure. - **Rate Limit Testing**: Verify rate limiting implementation. Detect endpoints vulnerable to abuse, brute force, or resource exhaustion. - **Schema Validation**: Test for improper input validation, mass assignment vulnerabilities, and data exposure through verbose errors. - **Shadow API Detection**: Discover undocumented API endpoints through traffic analysis in production. - **API Inventory & BOM**: Unified API Bill of Materials with per-endpoint risk scoring. ### Benefits - Secure APIs against OWASP API Security Top 10 - Automated testing from OpenAPI specs saves hours of manual work - Discover shadow APIs and undocumented endpoints - Test GraphQL, REST, and gRPC with unified tooling - SOC 2 compliance reports Learn more: https://sectora.io/features/api-security --- ## Supply Chain Analysis (SCA) Analyze open-source dependencies for vulnerabilities, license risks, and supply chain threats. ### Features - **Dependency Vulnerability Scanning**: Identify known CVEs by cross-referencing NVD, GitHub Advisory (GHSA), and CISA Known Exploited Vulnerabilities (KEV) databases. - **SBOM Generation**: Generate Software Bill of Materials in CycloneDX and SPDX formats for regulatory compliance (EO 14028, EU CRA). - **License Compliance**: Detect license conflicts and enforce policies to prevent legal exposure from incompatible open-source licenses. - **Transitive Dependency Analysis**: Analyze the full dependency tree — not just direct imports — to surface vulnerabilities hiding in transitive dependencies. - **Slopsquatting & Typosquatting Detection**: Detect AI-hallucinated package names (slopsquatting) and intentional typosquats (e.g., `lodsh-utils` mimicking `lodash`). - **Auto-Fix Pull Requests**: One-click remediation generates PRs to upgrade vulnerable dependencies to the nearest safe version with compatibility analysis. - **Continuous Monitoring**: Scheduled scans catch new vulnerabilities the moment they are disclosed for existing dependencies. - **Runtime Dependency Tracking**: Monitor live dependencies in production environments in real-time. ### Benefits - Prevent supply chain attacks by knowing every component in your software - Automated SBOM generation for regulatory compliance - Continuous monitoring catches new vulnerabilities in existing dependencies - License policy enforcement prevents legal risks - Auto-fix PRs reduce remediation time Learn more: https://sectora.io/features/sca --- ## Secrets Detection Find exposed API keys, passwords, tokens, and credentials in your codebase. ### Features - **100+ Secret Patterns**: Detect AWS keys, GitHub tokens, Stripe API keys, database credentials, private keys, and 100+ other secret types. - **Git History Analysis**: Scan complete repository history to find credentials that were committed and later removed — they still exist in git history. - **Low False Positive Rate**: Advanced pattern matching and entropy analysis minimize false positives. Each finding is validated for real risk. - **Real-Time Alerts**: Immediate notifications via Slack, email, or webhooks when new secrets are detected. - **Repository Scanning**: Connect directly to GitHub, GitLab, or Bitbucket for automated continuous monitoring of public and private repositories. - **Remediation Guidance**: Every finding includes steps to rotate the compromised credential and prevent future exposure. ### Benefits - Prevent credential leaks before they become breaches - Scan git history to find "deleted" secrets - Automated scanning for every commit and pull request - Clear remediation guidance reduces mean time to fix - Meet compliance requirements for secret management Learn more: https://sectora.io/features/secrets --- ## AI/LLM Security Test AI-powered applications against OWASP LLM Top 10 attack categories. ### Features - **OWASP LLM Top 10 Testing**: Prompt injection, jailbreak, sensitive data disclosure, excessive agency, model denial of service, and 5 more categories. - **Multi-Provider Support**: Supports OpenAI (GPT-4, GPT-3.5), Anthropic Claude, Google Gemini, Azure OpenAI, and custom LLM endpoints. - **Black-Box & Direct Testing**: Test LLM features through the application's web interface (black-box) or directly against the LLM API endpoint. - **Prompt Injection Detection**: Test for both direct and indirect prompt injection attacks that could manipulate AI behavior. - **Data Extraction Detection**: Verify that your AI application doesn't leak training data, system prompts, or sensitive information. - **WAF Protection**: Shield WAF rules specifically designed to block LLM attacks (prompt injection, jailbreak) at the edge. - **Shadow AI Monitoring**: Detect unauthorized AI/LLM services being used in your organization and enforce usage policies. Learn more: https://sectora.io/ai-security --- ## Shield WAF (Web Application Firewall) Always-on reverse proxy WAF that sits between users and your origin server on a global edge network. ### Features - **Automatic Virtual Patching**: When a CVE is disclosed or a scan finds a vulnerability, Shield auto-generates WAF rules. Protection deploys in seconds — no code changes needed. Close vulnerability windows while your team works on the permanent fix. - **Zero-Latency Edge Protection**: Runs on a global edge network across 300+ cities. Traffic inspected at the nearest point of presence with sub-millisecond overhead. - **API Schema Enforcement**: Upload your OpenAPI spec and Shield validates every incoming request against it. Non-conforming requests are blocked before reaching your server. - **Technology Fingerprinting**: Passively fingerprints your application's tech stack from live traffic. Technology-specific rules activate automatically. - **Shadow API Detection**: Monitors production traffic to discover undocumented endpoints that don't appear in your OpenAPI spec. - **WordPress & CMS Security**: 20-rule security preset with auto-detection for WordPress sites. - **Compliance Presets**: One-click OWASP 2025, PCI DSS 4.0, and LLM Top 10 rulesets. - **Bot Detection & Rate Limiting**: Block credential stuffing, brute force attacks, and automated scanners at the edge. - **Geo-Blocking & DLP**: Restrict traffic by country and prevent sensitive data leakage in responses. - **Credential Stuffing Protection**: Detect and block leaked credentials using Have I Been Pwned integration. - **Anomaly Scoring**: Composite threat scoring from multiple weak signals (unusual headers, suspicious patterns) with configurable thresholds. - **IP Reputation Analysis**: Real-time IP scoring based on threat intelligence feeds, abuse databases, and behavioral signals. - **Traffic Forensics**: Deep per-request analysis, IP timelines, session reconstruction, and attack pattern visualization. - **Universal DNS Compatibility**: Works with any DNS provider. Just add a CNAME record and protection starts immediately. ### Benefits - Block OWASP Top 10 attacks with auto-generated rules from your own scan results - Virtual patching closes vulnerability windows instantly - Real-time traffic analytics with per-request drill-down - Bot detection, rate limiting, and geo-blocking provide defense-in-depth - One-click setup: add domain, point CNAME, protection starts in minutes Learn more: https://sectora.io/features/shield --- ## Threat Intelligence Real-time CVE tracking, exploit intelligence, and technology-aware alerts. ### Features - **Real-Time CVE Tracking**: Processes NVD, GitHub Advisory, and vendor advisories within minutes of publication. - **CISA KEV Integration**: Instant alerts when vulnerabilities affecting your stack are added to the CISA Known Exploited Vulnerabilities catalog. - **Technology-Aware Alerts**: Alerts filtered based on your detected technology stack — only see threats that affect your applications. - **EPSS Scoring**: Exploit Prediction Scoring System integration to prioritize based on real-world exploit probability. - **Trending Vulnerability Analysis**: Track which vulnerabilities are being actively exploited, with social media signals and exploit availability data. - **Custom Watchlists**: Create watchlists for specific technologies, vendors, or CVE patterns. - **Virtual Patching Integration**: Threat intelligence feeds directly into Shield WAF rules. Protection auto-generated before you even patch. ### Benefits - Know about critical vulnerabilities before they make the news - Prioritize based on real-world exploit activity - Technology-aware filtering eliminates alert fatigue - CISA KEV compliance with automated tracking - Automatic virtual patching through Shield WAF Learn more: https://sectora.io/features/threat-intel --- ## Compliance Reports Generate audit-ready security reports for regulatory frameworks. ### Features - **Framework Mapping**: Map vulnerabilities to OWASP, PCI DSS 4.0, SOC 2, ISO 27001, and HIPAA frameworks. - **Professional PDF Reports**: Polished reports with executive summaries and technical details for stakeholders and auditors. - **Custom Branding**: White-label reports with your company logo — for security consultants and managed providers. - **Audit Trail**: Complete history of scans, findings, and remediation actions. - **Scheduled Reports**: Automatically generate and distribute weekly security summaries. Learn more: https://sectora.io/features/compliance --- ## Vibe Code Risk Score AI-era risk scoring for AI-generated and rapidly built applications. ### Features - **AI-Generated Code Analysis**: Purpose-built for code generated by Copilot, ChatGPT, Cursor, and other AI tools. - **Composite Risk Score**: Single 0-100 score combining DAST findings, dependency vulnerabilities, secret exposure, code quality, and attack surface complexity. - **A-F Letter Grades**: Risk grades across DAST, SCA, secrets, license, and WAF dimensions. - **Risk Trend Tracking**: Monitor how risk changes over time — identify if rapid development is increasing risk faster than remediation. - **Benchmark Comparison**: Compare against industry benchmarks. - **Actionable Recommendations**: Prioritized recommendations ranked by risk impact. Learn more: https://sectora.io/features/vibe-risk --- ## Additional Capabilities - **PR Security Gates**: Block vulnerable code from merging with CI/CD policy checks via GitHub Check Runs. - **Application Posture Management**: Unified risk view across DAST, SCA, and WAF per application. - **AI Auto-Fix**: AI-generated security fixes with one-click GitHub PR creation. - **Continuous Monitoring**: Scheduled scans with delta tracking and regression alerts. - **CVE Detection**: Match project dependencies against NVD, GHSA, and KEV vulnerability databases. --- ## Pricing ### Free — $0/month - 3 DAST targets, 5 scans/month - 1 API scan target - 5 repositories (SCA, Secrets, SAST) - Vulnerability management and CVE detection - 1 team member ### Pro — $99/month ($79/month annual) - 10 DAST targets, 50 scans/month - 10 API targets (REST, GraphQL, gRPC, SOAP) - 15 repositories (SCA, Secrets, SAST with AI filtering) - SAST + DAST cross-scanner correlation - Scheduled scans, Vibe Risk Score - Standard PDF reports - 5 team members ### Business — $199/month ($159/month annual) Everything in Pro, plus: - Shield WAF (10 domains) - Virtual patching, bot detection, geo-blocking - 25 DAST targets, unlimited scans, 50 repos - SAST with AI-generated code fixes - Compliance reports (PCI DSS, SOC 2, HIPAA, ISO 27001) - Priority support, API access, Jira/Slack integrations - 15 team members ### Enterprise — Custom pricing Everything in Business, plus: - Unlimited targets, scans, repos, Shield domains - SSO / SAML authentication - Custom branded reports - Shadow API & Shadow AI detection - PR Security Gates with SAST on every PR - Dedicated support with SLA - Custom integrations (Jira, Slack, PagerDuty) - Unlimited team members ### Add-ons (available on paid plans) - Extra targets: $20/mo per 10 targets - Extra scans: $15/mo per 50 scans - Shield WAF for Pro: $49/mo (3 domains) - Extra Shield domains: $10/mo per domain - Extra team members: $15/mo per 5 seats --- ## Coming Soon - **IaC Security**: Terraform and Kubernetes misconfiguration scanning - **Container Security**: Image scanning and runtime protection - **CSPM**: Cloud Security Posture Management for AWS, Azure, and GCP --- ## Security & Trust - Data encrypted at rest and in transit - Zero source code storage - SOC 2, GDPR, HIPAA, OWASP, PCI DSS compliance ready - 14-day free trial on Pro and Business plans --- ## Links - Homepage: https://sectora.io - Pricing: https://sectora.io/pricing - DAST Scanning: https://sectora.io/features/dast - API Security: https://sectora.io/features/api-security - Supply Chain (SCA): https://sectora.io/features/sca - Secrets Detection: https://sectora.io/features/secrets - Shield WAF: https://sectora.io/features/shield - AI/LLM Security: https://sectora.io/ai-security - SAST Code Analysis: https://sectora.io/sast - Threat Intelligence: https://sectora.io/features/threat-intel - Compliance Reports: https://sectora.io/features/compliance - Vibe Risk Score: https://sectora.io/features/vibe-risk - Security Gate: https://sectora.io/security-gate - Privacy Policy: https://sectora.io/privacy - Security: https://sectora.io/security - About: https://sectora.io/about - Request Demo: https://sectora.io/#request-demo - Login: https://sectora.io/auth/login - Start Free Trial: https://sectora.io/auth/login?trial=true