Continuous web security for teams without a security team

Know what's exposed.
Prove what's fixed.

Kynscope scans the websites you own, keeps the evidence and tells you exactly what to fix — then checks that it stays fixed.

Get notifiedSee how it works

Opening soon · Free during the beta · English and French

MediumOrigin reflected with credentials/api/cart · proof kept
LowNo Content-Security-PolicyFixed with one header, guide included
Cookie flags fixedverified by retest
Only sites you own. Ownership is verified before any scan.
Evidence for every finding. The request, the response, the hash.
Honest coverage. You see what was tested, and what wasn't.
HOW IT WORKS

From first scan to proven fix, in three steps.

No agent to install and no security degree required. Every result says what was tested and how sure we are.

01

Verify your site

Add a DNS record or an HTTPS file. Kynscope never scans a site it cannot prove you control.

_kynscope-challenge.example.com TXT
02

Scan within scope

Once or on a schedule. Discovery stays inside the site you verified, with bounded requests.

Quick scanScheduledVerified scope only
03

Fix, then prove it

Clear steps for your stack, then a targeted retest. A finding closes only when the evidence says so.

OpenRetestFixed
WHAT YOU GET

Powerful underneath. Simple on screen.

PROOF

Every finding comes with the evidence behind it.

Severity, confidence and priority are kept apart, so you know what is serious and how sure we are.

GET /api/cart → 200
origin: https://probe.invalid
access-control-allow-origin: https://probe.invalid
access-control-allow-credentials: true
sha256 ef6d86…4779e · rule cors.reflected-credentials
MONITORING

Keeps watching after the first scan.

Scheduled scans, new, fixed and reappeared findings, and alerts only when something changes.

Fix guidance

What happened, why it matters, the steps to take and how to check them.

English and French

The whole interface, the advice and the PDF reports, in the language you choose.

Code and site, side by side

Connect GitHub to add secret, dependency and infrastructure checks next to your live findings, linked only when the link is proven.

API keys and CI

Scoped, expiring and revocable project keys, and a command that blocks a release above the severity you choose.

FOR DEVELOPERS

Block risky releases from your pipeline.

A project API key, one command, a clear exit code. Nothing to host.

Example output
$ python3 kynscope_ci.py --api "$KYNSCOPE_API" \
    --asset "$KYNSCOPE_ASSET" --fail-on high
Kynscope scan 8f3c… admitted (queued).
Kynscope scan completed: 3 findings on record.
Gate passed.
OUR PROMISE

What Kynscope will never pretend.

An empty report isn't “secure”.

It means nothing was found in what we tested. We show you exactly what that was.

Silence isn't a fix.

A finding closes after a retest proves it, never because it stopped showing up.

No scan without permission.

Ownership comes first, and every request stays within the site you verified.

FREE BETA

The free beta opens soon.

Leave your email and we will write to you once, when Kynscope opens. The first 100 accounts get the free beta.

  • Up to 10 verified sites per workspace
  • 3 Quick scans per day, scheduled ones included
  • Up to 3 scheduled scans that keep watching
  • 3 GitHub repositories and 5 code analyses per day
  • Open to the first 100 accounts
  • No payment card required