Purpose
Decloak is positioned as a web security intelligence platform, aimed at developers, security teams, auditors, and enterprises, helping users quickly understand a website's security posture and providing citable evidence for compliance audits.
Main Capabilities
Free instant scan: paste any URL and get a complete snapshot covering 8 layers of security dimensions within 15 seconds, with no account or configuration required. The 8-layer analysis includes HTTP/TLS, HTML, network traffic, JavaScript CVE, tag managers, third-party supply chain, platform misconfigurations, server/CMS software CVE detection, and AI synthesis.
Specific detection items include: JavaScript CVE detection (Retire.js + OSV database, locating files and versions and linking CVE IDs), third-party domain mapping (classification, registration age, threat intelligence flags), security score and grade, independent active testing score, API endpoint discovery and testing (REST, GraphQL, SOAP), subdomain discovery and takeover detection, port and service discovery, Source map analysis, DNS record analysis (SPF, DMARC, DNSSEC, CAA), SSL/TLS certificate analysis, HTTP security header checks, server software CVE detection, CMS and platform fingerprinting, tag manager intelligence analysis, domain threat intelligence, and more.
AI and automation capabilities: the AI agent can crawl the entire site and perform 8-layer analysis on each page, providing a real-time reasoning trace; AI writes remediation steps for each finding; AI executive summaries summarize the security posture in plain language; a built-in chat assistant in reports can explain findings and guide remediation.
Penetration testing and active testing: the Enterprise edition provides non-destructive active probing (DAST), as well as sandboxed, explicitly consented real exploit confirmation testing, using a fixed toolset (sqlmap, dalfox, commix, nuclei, ffuf, jwt_tool), providing proof-of-exploit evidence, an independent penetration testing score, and a dedicated Pentest report PDF.
Compliance and evidence: supports mapping findings to standards such as SOC 2, ISO 27001, NIS2, DORA, LGPD, PCI DSS, NIST CSF, EU CRA, and more, generating timestamped PDF evidence reports and evidence package ZIPs, including audit trails (who, when, where, what configuration).
Collaboration and management: remediation tracking (Open/In Progress/Resolved/Accepted Risk), multi-user role permissions, scheduled recurring scans, Webhook integration, REST API, visual dashboard, shareable public links, comparison reports, and white-label PDF branding customization.
How to Use
Free scan: Visit the website, paste a URL, and get a report in 15 seconds, no account required. After registering, you can save reports. Authenticated scan: Capture a logged-in session via a browser extension; the agent crawls after login and supports passkey/WebAuthn. Expert mode: Configure scan profiles, including requests-per-second rate limiting, crawl depth, retry/backoff, custom User-Agent/headers/cookies, and URL exclusions. Active testing: Requires an explicit consent checkbox, runs in sandbox isolation, with network egress limited to the domain under test.
Use Cases
- Developers quickly check a website's security posture and get remediation guidance.
- Security teams perform continuous security monitoring and penetration testing.
- Enterprises prepare evidence for compliance audits such as SOC 2, ISO 27001, NIS2, DORA, LGPD, PCI DSS, NIST CSF, and EU CRA.
- Financial institutions and critical infrastructure entities meet DORA requirements.
- Teams using AI application building platforms (Lovable, Supabase, Base44, Bubble, etc.) detect common security misconfigurations.
- Share security reports with customers, developers, or auditors.
Limitations
Regarding the pricing model and prices, official materials do not provide specific information, so none is provided here for now. Free scans do not require an account, and paid tiers unlock more features. Some advanced features (such as penetration testing, DAST, scheduled scans, Webhooks, REST API, white-labeling, etc.) require registration or a paid account. Active testing requires explicit consent, and aggressive tiers require an additional liability acknowledgment.