FAQ
Frequently asked questions
What can I scan?
Only web applications you own or have explicit permission to test. You confirm this before each scan, and scanning without permission can be illegal.
How many free scans do I get?
Every verified account gets 4 free scans. One scan or access-control test uses one credit.
How do I get more credits?
Send a request from the Credits page in your account. The admin will contact you to confirm the details and add your scans.
How long does a scan take?
It depends on the size and speed of your application and which engines you choose, from a few minutes to about half an hour or more. Scans run one at a time, so yours may wait in a queue.
Can it test pages behind a login?
Yes. Add your login details when you start a scan. They're removed from the scan record once the scan finishes.
Does a scan affect my site?
It can. Engines send many requests, and some test for flaws such as SQL injection. Test a staging copy where you can, and avoid running scans when an outage would hurt.
Does it replace a penetration test?
No. Automated results are leads that should be validated, and scanners can miss issues. FlawStrike supports a professional security review but doesn't replace one.
Which report formats do I get?
PDF, SARIF 2.1.0 and JSON for every completed scan. See samples on the Reports page.
Ready to test your application?
Start with 4 free scans, or ask us a question first.