You can’t fix what you haven’t seen.
Legacy apps, new releases, and third-party plugins change the attack surface weekly.
Authorized DAST · OWASP ZAP engine
See what your web app exposes—before someone else does.
Bounded dynamic application security testing for permitted web targets. Clear findings. Executive-ready PDF. Engineering-ready detail.
Testing only with explicit authorization for your scope.
OWASP ZAPAuthorized scopeJSON & PDF reports
The cost of not knowing
Something could already be exposed on your site. Without a clear report, you decide in the dark—and the next incident will not send a warning email first.
Silence isn’t safety.
Missing headers, exposed debug paths, and leaky error pages rarely announce themselves in Slack.
Decisions without evidence are guesses.
Boards and regulators ask what you knew and when. A structured report turns anxiety into a prioritized plan.
The question isn’t whether risk exists—it’s whether you’ll discover it on your terms.
Authorized DAST, end to end
FixVector orchestrates OWASP ZAP with conservative limits, scope validation, and fail-closed egress—so traffic only goes where authorization and policy allow.
Assessment flow
Passive discovery is the default. Controlled active checks run only after separate, explicit consent.
How it works
Five steps from authorization to an integrity-checked report your team can act on.
- 1
Define authorized scope
Exact URLs, hosts, paths, and limits—with legal attestation recorded before any scan.
- 2
Validate & bound the target
Canonicalization and policy checks run before traffic leaves the controlled environment.
- 3
Discover & analyze
Crawl within limits; passive analysis of responses and behavior—no intrusive active suite by default.
- 4
Optional controlled probes
With separate consent, run only reviewed low-impact active checks—not a destructive full scan.
- 5
Review & report
Findings normalized, deduplicated, and redacted where needed; export JSON and PDF with severity and remediation narrative.
What we test
Methodology transparency: passive analysis by default, conservative active probes only when you authorize them.
Passive discovery & analysis
Crawl within scope, observe traffic, and run passive security analysis—no intrusive active attack suite.
- Security headers (CSP, HSTS, X-Frame-Options, and related transport-hardening signals)
- Cookie flags (Secure, HttpOnly, SameSite) and client-side exposure indicators
- Mixed content and transport issues
- Information disclosure patterns in responses
- Known vulnerable component indicators
- Cross-origin and framing signals (CORS, clickjacking-related)
Controlled active checks
When authorized, FixVector runs only these reviewed probes—each mapped to a ZAP rule ID for auditability.
ZAP-40028
ELMAH information disclosure
Error logs and stack traces can leak internals attackers reuse.
ZAP-40029
Trace.axd information disclosure
Debug endpoints expose request details and secrets.
ZAP-40032
`.htaccess` exposure
Server config leaks rewrite rules and sensitive paths.
ZAP-40034
`.env` exposure
Environment files often contain database URLs, API keys, and credentials.
ZAP-40042
Spring Actuator exposure
Management endpoints reveal health, env, and sometimes enable takeover paths.
Sample report preview
Illustrative data only—structured so leadership and engineering see what was observed, not guesses.
fixvector-report-preview.pdf
Cover summary
Dynamic Application Security Assessment Report
- Target
- https://example.com
- Overall risk
- MEDIUM illustrative
- Deliverables
- JSON + PDF
Severity breakdown
Critical1
High3
Medium5
Low8
HighConfidence: Medium
Environment configuration file exposed
Business impact
Credential and API key leakage can lead to account takeover and data breach.
Remediation
Remove public access; rotate secrets; block sensitive paths at the edge.
Request an assessmentfor a report outline tailored to your scope—or ask for our sample structure during onboarding.
Why the report matters
Stakeholders need evidence—not anxiety. FixVector reports are built for decisions.
Without a structured report
- Unknown exposure in legacy paths and plugins
- Engineering triages raw scanner noise without severity context
- Leadership hears “we think we’re fine” without documented scope
- Post-incident questions about what was known—and when
With FixVector
- Executive summary with severity breakdown and OWASP mapping
- Per-finding business and technical impact with remediation guidance
- Integrity-checked JSON for tooling plus PDF for the board
- Authorization and scope recorded—bounded testing, not chaos
Built for trust
Authorization-first
No scan starts without explicit scope and attestation. Fail closed when policy does not match.
Bounded scans
Rate limits, crawl caps, and conservative defaults keep testing proportional to your risk appetite.
Egress policy
Traffic leaves only toward permitted targets—conceptually aligned with controlled scan infrastructure.
Normalization & redaction
Findings deduplicated and sensitive details redacted where needed before delivery.
Operator review
Human review workflow before reports represent what your organization should act on.
OWASP-aligned mapping
Findings framed for engineering remediation and leadership communication—not fear metrics.
FAQ
Honest answers about scope, deliverables, and limitations.
Is this a penetration test?
FixVector delivers bounded DAST with optional conservative active checks—not an open-ended red team engagement.
Will this take our site down?
Scans are rate- and scope-limited. Active probes are opt-in and restricted to a reviewed allowlist at low attack strength.
Do you need our passwords?
The current offering is unauthenticated assessment. Login and session testing require a different engagement.
Can we get a PDF for executives?
Yes. Reports include an executive summary plus technical detail—designed for leadership and engineering audiences.
What if findings are wrong?
Findings support operator review and disposition. Automated scanner alerts can false-positive; reports are evidence for decisions, not certification.
Is scanning legal?
Only with explicit written authorization for the exact scope you provide. We record authorization and enforce scope before any traffic is sent.
How is this different from a default vulnerability scanner?
Authorization records, scope enforcement, conservative active policy, normalized findings, and integrity-checked JSON and PDF deliverables.
Do you guarantee compliance or that we are secure?
No. We do not guarantee security, compliance, or hack-proof status. Reports help you prioritize remediation—they are not a certification.
What testing is explicitly out of scope?
Destructive testing, credential attacks, denial of service, RCE validation, out-of-band exploitation, and social engineering are not part of the product story.
Get your security report
Tell us about your scope. We respond with next steps for authorized testing—no scan runs without your explicit approval.