One-off scans become ongoing coverage.

Register assets, put them on a schedule, watch for drift, and track risk over time. Scheduled and drift-triggered scans run the same gate → scan → billing path a manual scan does, so quota, concurrency and budget caps all still apply.

Start a scan Read the docs

3 cadences

daily, weekly or monthly, per asset

Anchored to now

re-arming a schedule never causes a catch-up stampede

Material only

fingerprints normalize CSRF tokens, nonces and timestamps so a dynamic page cannot false-drift

Overview GET /api/overview · CSV export org-wide

Every asset, its last scan, and what moved

A per-asset rollup: latest scan status, severity counts, the opened and resolved delta against the prior scan, and the schedule it runs on.

Assets

app.acme.com weekly · 0C 1H 2M · +1 / −3

api.acme.com/v2 daily · drift on · 0C 0H 1M

acme/support-agent CI webhook · 1C 2H 4M · +2 / −0

Trend, per asset

GET /api/assets/<id>/trend
scan 1 → open 9    scan 2 → open 6  (−3)
scan 3 → open 7  (+1)   oldest → newest, per step

Schedules require a paid plan Same billing path

Twelve weeks of one asset

Scheduled runs, and the two that fired because something changed.

drift

week 1 — open 9weekly cadence · trigger_on_change: trueweek 12 — open 2

drift-triggered, out of cycle scheduled, findings opened scheduled, nothing new

What continuous means here

Assets

An asset is a registered target you monitor. Register it, name it, and remove it when it is gone — removing an asset also drops its CI trigger keys.

Schedules

Daily, weekly or monthly per asset, merge-aware: changing the cadence keeps the drift toggle and vice-versa. The next run is anchored to now when re-armed.

Drift detection

Between scheduled runs the platform re-fingerprints a URL or API asset, preferring its OpenAPI spec. A material change enqueues an out-of-cycle scan; fetches and re-scans are rate-limited per asset.

Endpoints behind the dashboard.

For repo assets, prefer the CI webhook path

Endpoint

What it returns

GET /api/targets

Your registered assets

POST /api/schedules

Create or update a cadence, with trigger_on_change for drift

GET /api/overview

Per-asset rollup: status, severity counts, opened and resolved delta, schedule

GET /api/overview.csv

The same rollup as CSV, org-wide

GET /api/assets/<id>/trend

Findings over time for one asset, oldest to newest

Coverage that does not depend on someone remembering.

Put an asset on a schedule