📖 How To Use AI Vulnerability Scanner
📝 Step 1: Choose Scan Type
Select Codebase (for source code), Container (Docker images), or Cloud (Terraform, CloudFormation).
⚙️ Step 2: Paste Content
Paste your code, Dockerfile, or infrastructure-as-code in the input area.
🔧 Step 3: Configure Scan
Toggle CVE, misconfiguration, or secret checks. Click "Start Scan".
📋 Step 4: Review Prioritized Results
See findings sorted by severity and exploitability score. Copy or download JSON report.
💡 Pro Tips
Use "Sample" to load examples. Prioritize red/high EPSS findings first. Re-scan after fixes.
# Example finding:
CVE-2024-1234 (CVSS 9.8) - Critical
└─ EPSS: 0.95 (95% exploit probability)
└─ Fix: Upgrade curl to 8.4.0
❓ Frequently Asked Questions
What types of vulnerabilities are detected? ▼
We scan for CVEs (public vulnerabilities), cloud misconfigurations (like open S3 buckets), and secrets (API keys, passwords). Coverage includes 200+ CVE sources and 100+ secret patterns.
How is exploitability prioritized? ▼
We use EPSS (Exploit Prediction Scoring System) from FIRST.org, combined with CVSS severity. Findings with high EPSS (>0.5) are shown first, as they're more likely to be exploited in the wild.
Is my code sent to a server? ▼
No! All scanning happens locally in your browser. Your code, secrets, and infrastructure definitions never leave your machine. The CVE database is loaded client-side.
What container formats are supported? ▼
Dockerfiles and container scan reports. For full container image scanning, we recommend integrating with tools like Trivy – our scanner simulates that analysis.
Does it scan cloud infrastructure? ▼
Yes. Paste Terraform, CloudFormation, or Kubernetes YAML. We check for 50+ misconfigurations like public exposure, weak encryption, and excessive permissions.
What are common secrets detected? ▼
AWS keys, GitHub tokens, Slack webhooks, private SSH keys, database connection strings, and 20+ other patterns. We show line numbers to help redact.
How accurate is the prioritization? ▼
EPSS is updated daily and provides probability of exploitation within 30 days. It's 70-80% accurate at predicting exploits, making it industry standard for prioritization.
Can I export reports? ▼
Yes, use the Copy or Download (JSON) buttons. JSON includes full details: CVE IDs, severity, EPSS score, and remediation advice for integration into your workflows.