Free Scan

Website scanning feature

SPA security scanner: browser scanning for single page applications

Many single page applications show their pages and make their requests only after JavaScript runs. ScanTitan can explore a JavaScript website with an isolated browser, so dynamic navigation and requests are discovered instead of missed, and each scan reports what was covered and what was not.

  • Isolated browser exploration
  • Dynamic request discovery
  • Coverage and limits in every report

Start with a free account. Free includes one website and one included website security scan. Registering does not activate paid features.

Create free accountSee how exploration works

Why single page applications hide pages and requests

A traditional website sends a separate HTML page for every URL, so a crawler can follow links and find them. A single page application sends a small HTML shell and builds the views, routes and API calls in the browser with JavaScript. A scanner that only reads HTML sees very little of that.

For the owner of a JavaScript website this matters in three ways:

  • Client-side routes that exist only after a menu or button is used are not linked in the HTML.
  • Requests to your own APIs are made when a view loads, so they are visible only if the page actually runs.
  • Forms and components are rendered by scripts, so there is nothing to test until the page has rendered.

ScanTitan does not certify specific frameworks or versions. It works with what the browser renders and requests on your site. For dependency and library findings, see the JavaScript vulnerability scanner, which is a different check from browser exploration.

How the SPA security scanner explores a JavaScript website

  1. Choose an active testing depth. A broader profile such as Extended testing gives complex websites more time. It can generate more traffic and does not guarantee complete coverage.
  2. Turn on Explore interactive pages. An isolated browser discovers supported JavaScript navigation. This setting is available with active testing depths.
  3. Set the application request budget. It is a stopping budget for application tests. In-flight requests may finish, and it does not count requests made by other features.
  4. Choose content inspection. Content and browser observation also watches how the landing page and its scripts behave inside the isolated browser.
  5. Read the coverage. The report lists the areas that were covered and the areas that were skipped, so a completed scan is not mistaken for complete coverage.
ScanTitan Advanced controls showing Extended testing, the Explore interactive pages option, an application request budget and the content inspection level
The advanced controls that enable browser exploration. The request budget shown is a saved example, not an allowance or a completion guarantee.

Scope and limits

Browser exploration is bounded. It does not try every route, authenticated workflow or business transaction.
  • It applies to website scans when the option is enabled and the chosen profile supports it.
  • Scope, page, request and time budgets still apply to every scan.
  • Run it only on websites you own or are authorized to test.
  • Imported API scans do not use browser exploration or out-of-band callbacks. See the API vulnerability scanner for supported API formats.
  • Eligible active website profiles can also use correlated out-of-band callback checks for selected blind SSRF and XXE cases. This is not a promise to find every blind injection type.

Plans and where to start

Create a free account to run the included website security scan. Whether browser exploration runs depends on the scan profile you select, and the pricing page lists what each plan includes. Business adds extended controls and server and API assets, and Consultant adds client organization and branded reports.

See pricing for the annual price per asset place, or the Consultant plan if you assess websites for clients. The main website vulnerability scanner page covers the wider web assessment.

SPA scanning questions

What is an SPA security scanner?

It is a website scanner that runs your JavaScript application in a browser, so pages and requests that only appear after scripts run can be discovered and assessed. ScanTitan does this with an isolated browser when Explore interactive pages is enabled for a supported profile.

Does it test every route in my application?

No. Exploration is bounded by scope, page, request and time budgets, and it does not exercise every route, authenticated workflow or business transaction. The coverage report shows what was covered and what was skipped.

Which frameworks does it support?

ScanTitan does not certify specific frameworks or versions. It assesses what the browser renders and requests, whichever framework builds the site.

Is browser exploration only on Business?

Availability depends on the scan profile. The pricing page lists the plans and what each includes. Registering does not activate paid features.

How is this different from the JavaScript vulnerability scanner?

The JavaScript scanner reports dependency and library observations. Browser exploration discovers dynamic pages and requests at runtime. They answer different questions.

Can it scan an API?

Imported API scans use a different workflow and do not use browser exploration. See the API vulnerability scanner for the supported formats and limits.

Is it safe to run on production?

Extended testing can generate more traffic. Use the request budget, and only scan websites you own or are authorized to test.

Scan your JavaScript website

Create a free account to run the included website security scan and read the coverage report for your single page application.

Create free accountCompare plans