Built by one person,
for people who ship fast.
SecScan (secscan.us) checks a live web application from the outside, explains what it finds in plain English, and says plainly what it did not test. It was built by Carlos Cuellar. This site, secscan.info, is its reference documentation.
Who builds it
Carlos Cuellar is self-taught. For years Cuellar worked on computers as a technician, repairing Windows machines and doing networking work. Then came an AI model, and the work has not stopped since.
Cuellar has worked with hundreds of models, prompting and re-prompting until ten words were enough to build what was wanted. That taught a lesson the hard way: a builder is only as good as the model in use, and a model rarely says what it left out. SecScan is built around that lesson.
Why SecScan exists
AI tools made it possible to ship an app in a weekend. They did not make it safe. The same problems keep reaching production: databases anyone can read, secret keys in the front-end code, config files left public. None of them show up when someone clicks around their own app. SecScan looks at the live app the way an outsider would. Each problem comes with a plain-English explanation and a fix that can be pasted straight back into the AI editor the app was built with.
What it does today
- Scans a live site and grades it A to F, with every finding explained and a fix to paste back into the editor. How it works.
- Watches a site around the clock. Uptime, certificate and header checks run on a schedule, and a full rescan follows the grade: sites that score worse are looked at more often. Problems arrive by email. A first site is watched free. Monitoring.
- Gives a site a grade badge for a README or a footer. It shows the grade and the scan date, never the address or a finding, and it goes grey and says "old scan" once it is a month old, so a grade cannot outlive the site it was earned on.
- Works inside AI editors and over an API, so a scan can be started, and its results read, without leaving the tool the app was built in. AI editors · Developers.
Every account gets free scans each month. A paid plan changes how many scans there are, never which checks run. See pricing for the current plan.
What SecScan promises
- It says what it didn't test. Every scan records which tests ran and which were skipped, and why. A clean report never quietly means "we didn't look".
- The AI explains; it never invents. Findings come from the scanner. The AI writes the explanation and the fix, and only about what the scan found.
- It is tested against known answers. The scanner runs against a deliberately vulnerable app where every problem is planted and must be caught, and against well-run sites where it must stay quiet. The misses are published with the hits. How we test · the false-positive record.
- Active tests only on sites you prove you own. Anything that sends real attack traffic waits for a DNS record or a file on the domain. Until then the report names what is waiting.
- Depth is never for sale. Free and paid scans run the same checks. A plan buys volume, not coverage.
- No certificates it can't give. SecScan is an automated scanner, not a penetration test, and never says an app is "compliant" or "certified".
Built with AI, like the apps it checks
SecScan itself was built the way many of its users build: with AI models, one prompt at a time, then tested until its results could be trusted. That is exactly why it exists. Cuellar knows how fast AI lets a person ship, and how easy it is to miss what it did not do.
Not to be confused with
"SecScan" is a name several unrelated tools share. This one is the web application security scanner at secscan.us. It is not SecScan.io, which is an IT baseline and compliance product, and it is not an open-source tool that scans source code for secrets.
Get in touch
Questions, a finding that looks wrong, or an idea: [email protected]. The same page, in the app, is at secscan.us/about.