Security scanning

1. Add a target

Open Numo Guard, create a project, and add an asset by URL. Passive posture checks — TLS, security headers, cookies, exposed files, and DNS/email records — start immediately, no verification required, and set the first grade.

2. Verify ownership to scan deeper

Add the TXT record Guard shows you, then click Verify ownership. This unlocks the active DAST + fuzzing suite (XSS, SQLi, SSTI, path traversal, CORS). Active scans are GET-only, rate-limited, and non-destructive; for authenticated coverage, add an auth header on the asset and Guard scans behind your login.

_numo-guard.example.com  TXT  "numo-guard-verify=<your-token>"

3. Gate your deploys (CI/CD)

Fail a build when a target regresses. With an org API key, queue a scan and poll it to a pass/fail verdict — it exits non-zero on any open finding at or above your fail_on threshold.

start=$(curl -fsS -X POST \
  https://api.numo.sh/v1/orgs/<org>/security/assets/<id>/gate \
  -H "Authorization: Bearer $NUMO_API_KEY")
poll=$(jq -r .poll_path <<<"$start")

# poll until done, then fail the build if not passed
res=$(curl -fsS "https://api.numo.sh$poll?fail_on=high" \
  -H "Authorization: Bearer $NUMO_API_KEY")
[ "$(jq -r .passed <<<"$res")" = "true" ] || exit 1

The exact snippet — shell and GitHub Actions — is on each asset's page, pre-filled with your org and asset ids.

4. Monitor, prove, and fix

• Continuous monitors — new-certificate watch, look-alike/typosquat detection, breach-directory lookups, and homepage defacement alerts.
• Shareable report — publish a redacted trust report with your grade and an OWASP / PCI / SOC 2 compliance scorecard.
• AI remediation— turn any finding into a concrete fix plan; it's cached per finding and metered by your plan.