Anatomy of a Scan: What the Engine Actually Does
A scan is not a curl request. We walk through every stage — from queueing a URL to producing a verified verdict — so you know exactly what powers your alerts.
Every scan begins as a job in a priority queue. Paid plans with short intervals get higher priority, but every job runs the same pipeline so results are comparable across tiers.
Stage one is acquisition: a real Chromium instance, not a header-only fetch, loads the page with JavaScript enabled. We hook service worker registration, fetch initiators, and dynamic import calls so nothing loaded at runtime escapes the record.
Stage two is analysis. We diff the observed script tree against your baseline, score new or mutated resources, and run behavioral heuristics that flag exfiltration patterns — POSTs to freshly registered domains, keystroke listeners on payment fields, or obfuscated payloads decoded at runtime.
Stage three is verification. Before anything reaches your inbox, suspicious findings are re-run in a clean session to rule out flakiness. Only a stable, reproduced result becomes a verdict — that is why our alerts are worth acting on.