Skip to content
Safe-by-default DAST

Continuous security testing with safeguards designed to reduce scan impact.

MIAN DAST records target authorization and provides scope controls for scanner jobs. Those safeguards reduce risk; they do not guarantee a scan will have no impact.

Run free auditOpen scan dashboard
Static illustration of a target service and a scope boundary. This is not a running scan.

Illustration · no scan running

Current implementation

Control plane

Cloudflare Worker and D1

Queues and stores scan jobs, status, and results.

Scan execution

Operator-managed Python agent

Runs implemented checks against authorized, in-scope targets.

No third-party CI, ticketing, or cloud-posture integration is claimed here. Framework names are reference mappings only; MIAN DAST does not claim compliance certification.

Current safety controls

Scope checks and conservative requests. Not a zero-impact guarantee.

These controls reduce risk; they cannot guarantee that every target will be unaffected. Use systems you own or have explicit authorization to test, and validate in staging before production.

Control · 01

Authorization record

A target registration requires a named authorization attestation before a scan can be queued.

Control · 02

Host and path scope

The Python request layer checks each requested URL against the registered allow-list and blocked paths.

Control · 03

Request policy

The baseline blocks state-changing HTTP methods and applies rate and request-count limits.

Control · 04

Auditable outcome

The dashboard distinguishes queued, failed, and completed jobs. Only completed agent results are reported as scan findings.

Free · no sign-up

Run a limited HTTP posture check.

The service makes limited HTTP requests to the URL you submit and checks exposed response configuration. This is not a Python-agent DAST scan; submit only a domain you are authorized to assess.

  • No exploit payloads or fuzzing
  • TLS, HSTS, CSP, CORS and cookie flags
  • A result only when the audit endpoint returns real check data
–

Awaiting target

—

  • TLS
    Pending
  • HSTS
    Pending
  • CSP
    Pending
  • CORS
    Pending
  • Cookies
    Pending

Limited HTTP posture check · not a completed DAST scan

Actual scan lifecycle

From authorized scope to evidence. No animated sample run.

  1. Step 01

    Register a target

    Record the system, scope boundaries, and named authorization in the control plane.

  2. Step 02

    Run the Python agent

    An operator-managed agent polls the queue and sends in-scope HTTP requests using implemented checks.

  3. Step 03

    Wait for completion

    Queued and claimed jobs are not findings. The agent must finish and submit results.

  4. Step 04

    Review evidence

    Completed findings include observed details and remediation guidance; guidance is not an applied code fix.

Implemented Python checks

A focused read-only scan set. No advertised engine counts.

The operator-managed agent runs checks against the registered scope. A check family is not evidence that a target was tested: each scan report lists only findings returned by a completed agent run. Destructive mutation tests are not currently implemented.

Implemented check · 01

Security headers

Read-only review of CSP, HSTS, framing, referrer, and cookie flags.

Implemented check · 02

Reflected input

Tokenized XSS probes with response validation; endpoints need discoverable parameters.

Implemented check · 03

Injection signals

Benign SQL error and boolean-difference probes; no data-changing payloads.

Implemented check · 04

HTTP configuration

Implemented checks include CORS, redirects, methods, and information disclosure.

Python agent

A real execution path. Not a CI demo.

  1. 01 / Queue — dashboard submits an authorized scan job to the Worker.
  2. 02 / Execute — a separately operated Python agent claims the job and runs the enabled read-only checks.
  3. 03 / Evidence — the agent reports completion and findings; queued status alone is not a result.

The agent must be installed, configured, and online. No GitHub Actions, GitLab, SARIF, or build-gate integration is claimed.

Review current scope →

Evidence, not a mock report

Completed scans only

Results are tied to actual scan runs.

What a result contains

  • Scan ID and completion status from the Python agent flow
  • Findings with observed evidence and request context
  • Remediation guidance for an operator to review

No sample findings, auditor certification, signed timestamps, or guaranteed fixes are represented here. Reports are available only when a real scan has completed.

See implemented features →
Founder

Built to test production without collateral damage.

Dave Mian designs MIAN DAST around attestation gates, boundary fences and adaptive canaries, so security teams can scan live systems without gambling uptime.

Based in
Abu Dhabi, UAE
Role
Principal architect
About MIAN →
“If a scanner can take production down, it does not belong in production.”
Dave MianFounder · MIAN DAST
Pricing

Predictable pricing for teams that ship daily.

Pricing is informational while billing activation is unavailable. Checkout does not currently provision a subscription or enable paid features; contact us to discuss access.

Reference prices · USD / month · not purchasable here

Starter

Exposure defense

$19/mo

—

Automated DAST for a single app and continuous perimeter checks.

  • +26-engine DAST pack
  • +1–3 domains
  • +Telegram & webhook alerts
  • +Attested PDF reports
  • +Safe-by-default only

Developer

CI/CD ready

$99/mo

—

Authenticated scans, API contracts, and headless CI hooks.

  • +Everything in Starter
  • +Authenticated scanning
  • +GitHub Actions / GitLab
  • +OpenAPI import
  • +SARIF export
Recommended

Growth

Fleet multi-scan

$299/mo

—

Recommended for teams shipping daily across a SaaS surface.

  • +Everything in Developer
  • +4–15 domains
  • +Fleet multi-scan
  • +Jira / Linear sync
  • +14-day free trial

Enterprise

MSP & compliance

$899/mo

—

High-throughput scanning, seats, and auditor portals.

  • +Everything in Growth
  • +16+ domains / MSP
  • +RBAC seats
  • +White-label reports
  • +Dedicated canary SLA
Talk to sales →
Compare all features →
FAQ

Straight answers before you scan.

01What safeguards apply to scans?

Scan jobs record authorization and enforce configured target scope, request policy, and rate limits. These controls reduce risk but cannot guarantee zero impact. Use staging first where possible.

02What is the difference between baseline and expanded checks?

Both modes use the currently implemented read-only checks. Expanded mode enables more of those checks; destructive mutation testing is not currently implemented.

03Are findings guaranteed to be true positives?

No. Findings include available request evidence and remediation guidance, but an operator should validate the result in context. Checks do not all have the same level of confirmation.

04Does MIAN DAST provide a CI/CD gate or ticketing integration?

Those integrations are not currently presented as working product features. Repository scanning is a separate workflow and does not imply a CI gate or automatic ticket creation.

05What does the free audit check?

It runs a limited HTTP posture check. It is not a full Python-agent DAST run, and its result should not be confused with a completed agent scan. Review the result and feature status for exact current coverage.

Named authorization Scope records Operator-managed agent

Review what is implemented before your next deploy.

Run free audit

100% passive · no sign-up · about ten seconds