Find Vulnerabilities in the Web Apps and APIs You Own
Application security for the web applications and APIs you own, in early access: prove you control a target and run passive scans from your own servers today, with findings, CWE references and triage tracked from scan to scan; active OWASP Top 10 and OWASP API Security Top 10 testing and compliance mapping are rolling out.
Core Offerings & Service Capabilities
Comprehensive capabilities designed to deliver immediate visibility, security, and operational efficiency for Application Security.
Ownership Verification
A target is never scanned until you prove you control it, and a named person in your organization signs for it.
- DNS TXT record at _syntoric-challenge.<host>, a file at /.well-known/syntoric-verification, or a meta tag on the home page
- Internal addresses proved by the allowlist on one of your own servers, which Syntoric cannot change
- Signed by a person with multi-factor authentication and a verified email; the signature is recorded
- Checked again every day; a target whose proof is gone stops being scannable
Scan Hosts You Choose
Choose which of your servers connected through Fleet Manager may scan each target. Scan traffic leaves from those servers, never from Syntoric's own.
- Choose which of your connected servers may scan each target
- Reach internal applications without opening them to the internet
- Your server's operator decides whether it may run scans at all
- Scan traffic from your server restricted to the target's own addresses
Passive Scans and Findings
Run a scan of a verified web application, follow it live, and work through what it finds.
- Passive checks only: security headers, cookie flags, cross-origin policy, information leakage, directory listing, mixed content, TLS configuration and certificates
- Live progress, and a cancel that stops a scan
- Findings with severity, evidence (sensitive values masked), CWE references and remediation guidance
- Tracked from scan to scan as new, unchanged, fixed or regressed, with an owner, due date, suppression and notes
Safe Scanning Principles
Scans are built to be run against production: limited, inside the scope you set, and never destructive.
- Request rate per target (10 per second by default, from 1 to 100) and a concurrency limit, slowing down when your site answers 429 or 503
- Every request checked against the target's scope: no redirect or DNS change can lead a scan outside it
- No denial-of-service or load checks in any mode; PUT, PATCH and DELETE only to API operations you mark safe
- Every request identifies itself as Syntoric's scanner with the scan's ID, so you can find and filter it
Active Testing, Compliance Mapping and Reports
Active vulnerability and API testing, with findings mapped to the standards you report against.
- Active OWASP Top 10 testing: injection, cross-site scripting and request forgery
- API security testing from OpenAPI or GraphQL definitions, with authorization checks across sign-in identities, and sensitive data exposure detection
- Findings mapped to OWASP Top 10, OWASP API Security Top 10, PCI DSS, SOC 2 and GDPR controls, with compliance reports
- SARIF and CSV exports, a CI check, scheduled scans and advisory AI-assisted triage
Operational Architecture & Control Plane Guarantees
Rigorous data sovereignty, least-privilege security boundaries, and high availability metrics engineered for Application Security.
Deployment Model
Targets and their proof live in Syntoric; scans run on your own Linux servers connected through Fleet Manager, never on Syntoric's servers.
Data Plane Isolation
Scan traffic goes only from your servers to the addresses of targets you verified; sensitive values in evidence are masked before upload.
Latency Profile
Proof checked when you verify and again every day; scans limited to 10 requests per second per target unless you change it, 4 scans per target per day and 3 running at once per organization.
Compliance & SLA
Maps findings to OWASP Top 10, OWASP API Security Top 10, PCI DSS, SOC 2 and GDPR controls; a scan does not certify compliance.
Scope & Platform Capabilities
Vulnerability scanning of your own web applications and APIs from your own servers, after you prove you control them.
Available now
- Add web applications and APIs as targets: a base URL, the path prefixes a scan stays under, paths it never requests and, optionally, every subdomain
- Prove you control a target with a DNS TXT record (recommended, and the only proof that covers subdomains), a file under /.well-known on the site, or a meta tag on its home page
- Internal applications Syntoric cannot reach: proved by the operator of one of your own servers adding the address to that server's allowlist, which Syntoric cannot change
- Verified by an accountable person: someone with the verify permission (organization owners by default), signed in with multi-factor authentication within the last ten minutes, with a verified email address, in an organization with automatic payment on or a paid invoice, who signs a statement that they own the target or are authorized to test it; who signed, when and from where is recorded
- Proof checked again every day: a target whose proof is gone, or whose verifier left the organization or lost the permission, goes back to unverified until someone verifies it again
- Changing a target's host, its proof method or widening it to subdomains makes it pending again
- Choose which of your own connected servers may scan each target, with a request rate and concurrency limit per target
- Run a scan of a verified web application from one of your own connected servers, with live progress and a cancel that stops it
- Passive checks only: security headers, cookie flags, cross-origin policy, information leakage, directory listing, mixed content, TLS configuration and certificates
- Scan traffic from your server restricted to the target's own addresses, so a scan cannot be steered anywhere else
- Findings with severity, evidence (sensitive values masked), CWE references and remediation guidance
- Findings tracked from scan to scan as new, unchanged, fixed or regressed
- Triage: assign an owner and a due date, suppress a finding with a reason, and add notes
- Fair-use limits: 4 scans per target per day and 3 scans running at once per organization
- Every target change, verification and scan recorded in the audit trail
Rolling out
In development for Application Security and not available yet.
- Rolling out: Active vulnerability testing: a crawl of the site and checks for OWASP Top 10 issues such as injection, cross-site scripting and request forgery
- Rolling out: API security testing from your OpenAPI or GraphQL definitions, including authorization checks that compare what two or more sign-in identities can reach
- Rolling out: Sensitive data exposure: personal data and secrets in responses, masked on your server before any evidence leaves it
- Rolling out: Compliance mapping: findings mapped to OWASP Top 10, OWASP API Security Top 10, PCI DSS, SOC 2 and GDPR controls, shown in Continuous Compliance, with compliance reports
- Rolling out: Exports: SARIF and CSV, and a printable report
- Rolling out: A CI check that fails a build on findings above a severity you choose
- Rolling out: AI-assisted triage, fix suggestions and scan summaries on your project's own model, advisory only: a person decides what happens to a finding
- Rolling out: Scheduled scans with scan windows
Implementation & Infrastructure-as-Code
Provision, configure, and automate Application Security using the Syntoric CLI, the REST API and JSON specifications.
# Add a target, then verify it once its DNS TXT record is published
curl -X POST "https://api.syntoric.com/v1/appsec/targets" \
-H "Authorization: Bearer $TOKEN" \
-H "X-Syntoric-Org-Id: $ORG" -H "X-Syntoric-Project-Id: $PROJECT" \
-H "Content-Type: application/json" -d @target.json
curl -X POST "https://api.syntoric.com/v1/appsec/targets/$TARGET/verify" \
-H "Authorization: Bearer $TOKEN" \
-H "X-Syntoric-Org-Id: $ORG" -H "Content-Type: application/json" \
-d '{"method": "dns", "attestation": {"version": "'$VERSION'", "accepted": true}}'Enterprise & Technical Questions
Key questions about architecture, compliance, credential security, and deployment for Application Security.
More in Cloud Security & Governance
Cloud Security Posture Management (CSPM)
Agentless CIS benchmark scans, IAM role drift, and multi-cloud posture across AWS and Azure.
Continuous Compliance & Audit
Real-time posture tracking against SOC 2 Type II, ISO 27001, HIPAA, and PCI DSS v4.0.
Vulnerability Management
Aggregates provider CVE findings and patch gaps by instance, container image, and function.
Audit Trail & Event Streaming
Cryptographically verifiable, append-only transaction stream recording all control plane mutations.
Certificate & DNS Management
SSL/TLS expiration lifecycle, renewal monitoring, and dangling DNS subdomain detection.
See Application Security on Your Own Cloud
Book a technical walkthrough with our team to see it working against your own environment.