The X-Ray of your app,before someone else finds it

We open every page in a browser and only read it once it has really finished loading: network idle, DOM stable, animations done. No guessing from the word “loading”.

We map what any visitor reaches and, with your session, what only exists after login. It is the difference between photographing the façade and walking into the house.

We record what your app actually called: method, host, path template and flags (authenticated, write, carrying sensitive data). If you publish OpenAPI/Swagger, we read the declared contract too.

When we find many pages with the same shape (products, posts, profiles), we ask whether it is a catalog and collapse them into a single line. Testing the same page model three hundred times measures nothing extra and does not eat your quota.

Beyond the links, we start from your sitemap.xml and your robots.txt. And the language prefix (/pt-BR/…) does not collapse the whole site into a single route.

Mapping saves every 10 pages. If it runs out of time, you do not lose what has already been discovered.

You sign in once inside a remote browser, solving MFA, modal and anti-bot challenge as a human. We store only the session, encrypted. Your password is never stored.

The session is read from all four surfaces, including httpOnly cookies. It works with modal login, two-step login or an external provider.

Register “Admin”, “Free customer”, “Paying customer” once and reuse them in every analysis, with the session status always visible.

It is the only way to see what one customer's account reaches inside another's data. One login on the Basic plan, two on Pro, three on Premium.

We browse every page with your session and record what happened: the status, where navigation stopped, and whether real content came back or a login screen.

On every page you pick: CSP, HSTS, X-Frame-Options and frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin isolation and Server/X-Powered-By exposure.

We look for service keys, admin keys, storage tokens and payment keys leaked in the bundle. We store the evidence masked: the origin, never the value.

RLS turned off, public catalog, open bucket, open Firestore and Realtime Database, public collection, GraphQL introspection turned on.

We probe /.env, appsettings.json, config.json and the like, with three guards against false positives so your framework's error page does not get called a leak.

Two accounts, the same identifier: does one user reach the other's data? It is the definitive proof of leakage between customers, and it requires two logins.

Leaked secret key, sandbox running in production, amount set by the client, confirmation in the browser and missing idempotency. We never complete a purchase nor touch a real card.

A scan with the nuclei corpus: 10,518 templates, plus around 249 specific to web applications. It only runs with ownership validated and your explicit acceptance.

DNS (DNSSEC, CAA, dangling subdomain) and domain expiry, SPF/DKIM/DMARC, TLS certificate validity and the HTTPS redirect, technical SEO, AI search and LGPD compliance.

Cover, risk verdict, executive summary, readiness score, severity distribution, per-page score and every finding numbered with evidence, how to fix it and an OWASP/CWE reference. Ready to print or to send to your client.

Your site's tree with a score per page and coverage by scanner, plus the APIs, BaaS, domain, payments, results and executions tabs.

Add pages by hand, fire a mapping from a specific page, mark what is not relevant, delete what does not matter and label each page (Login, Payment, Form with personal data, Admin, Protected).

One score per page and one for the whole app, with the problems ordered by risk. What to fix first sits at the top.

Connect ecoa to Cursor, to Claude or to another assistant through our MCP server: it reads the findings and gets the remediation guide along with them, with the guardrails that prevent a “fix” that breaks your app.

And why. A partial scan never turns into “your site is clean”. A detected Server Action, for instance, is reported as not tested, never as passed.

The review screen lists every test in the queue, what was left out and why. What is blocked is not a choice; it is an explanation.

Line by line, with the address of each page as it is analyzed. You can leave it running and go get a coffee.

Every execution keeps what was requested, what ran, how long it took and how many findings came out. You can compare it with the previous execution.