Scanning capabilities
What each scan engine checks
A ScanBastion scan is not one black box. It is four kinds of check, each with a defined purpose, a known traffic pattern and known blind spots. These pages describe what each engine looks for, what a finding from it means, and what it cannot tell you.
Two scan profiles are planned for the first release. Quick runs the passive checks only and is the right first scan for any newly verified target. Standard adds curated Nuclei templates, which send specific detection requests. Both profiles keep request rates bounded, run under timeouts, and can be stopped at any point. The Responsible Scanning Policy sets out the rules every scan is bound by.
| Check | Quick | Standard | Traffic |
|---|---|---|---|
| HTTP security headers | Yes | Yes | Ordinary page requests |
| TLS and certificate | Yes | Yes | TLS handshakes |
| Passive OWASP ZAP | Yes | Yes | Bounded crawl of public pages |
| Curated Nuclei templates | No | Yes | Specific, non-destructive detection requests |
All checks are planned for the first release and subject to change. Not included in the first release: active ZAP scanning, authenticated testing, port scanning and scheduled rescans.
HTTP security headers
What the HTTP security headers check looks for: HSTS, Content-Security-Policy, frame protection, cookie flags, referrer and permissions policies, and how findings are graded.
TLS and certificate analysis
How ScanBastion assesses a site's TLS configuration: protocol versions, cipher suites, certificate validity and chain, hostname match, key strength and HTTPS redirects.
Passive OWASP ZAP assessment
What a passive OWASP ZAP scan is, which passive rules run, what traffic the target receives, and why passive analysis is safe for production websites.
Curated Nuclei vulnerability checks
How ScanBastion uses ProjectDiscovery's Nuclei: which template categories are allowed, which are excluded, how request rates are bounded, and why matches need review.
How findings from different engines are reconciled
Several engines can notice the same thing. ZAP's passive rules and the headers check both see a missing Content-Security-Policy; a Nuclei template and the TLS check may both flag an expired certificate. Findings are consolidated per target so each issue appears once, with the engines that observed it listed as sources, and the report counts an issue once rather than inflating the totals.
Every finding, whichever engine produced it, carries three separate fields: severity (how bad it would be if real), confidence (how sure the engine is) and verification (whether a person has confirmed it). The guide Severity, confidence, verification explains how to read them together.