Question 1

Is ShieldReport a penetration test?

Accepted Answer

ShieldReport combines automated scanning with optional Advanced AI Pen Test Results. Core scans are non-intrusive posture checks; Pro and Agency can also run controlled exploit validation via Shannon in authorised test environments.

Question 2

What is included in a full web scan?

Accepted Answer

Full scans run the enhanced web pipeline (asset discovery, vulnerability templates, TLS, policy checks, and evidence mapping). Findings are deduplicated and severity-normalised before report generation.

Question 3

What are Advanced AI Pen Test Results?

Accepted Answer

Advanced AI Pen Test Results are a dedicated report section powered by Shannon. They focus on validated exploit paths such as auth/authz flaws, injection, XSS, SSRF, IDOR, and business-logic abuse, with reproducible evidence.

Question 4

Does Shannon test web applications or only cloud?

Accepted Answer

Shannon is focused on web application security testing. Cloud posture checks are handled separately via Prowler for AWS and merged into the same report.

Question 5

Can ShieldReport test WAF effectiveness?

Accepted Answer

Yes. We can run WAF fingerprinting by default, and optional safe bypass probes when explicitly enabled. Bypass probes are rate-limited and designed for authorised testing only.

Question 6

How are false positives and duplicate findings handled?

Accepted Answer

Scanner output is normalised through an in-house mapping layer. Duplicate issues are merged and noisy results can be classified as pass or informational when access is blocked and risk is low.

Question 7

Do Pro and Agency include cloud scanning?

Accepted Answer

Yes. Pro and Agency can run AWS cloud posture checks (Prowler-backed) and merge cloud findings into the same report workflow as web findings.

Question 8

What do I need to connect AWS?

Accepted Answer

You provide a role setup with least-privilege access and allow the ShieldReport worker identity to assume it. Once connected, scans can run on selected regions and report failed cloud controls.

Question 9

What do I need to run Advanced AI Pen Test Results?

Accepted Answer

You need explicit authorisation, a target URL, and for best coverage a repository URL plus test credentials. We recommend running against staging or a dedicated test environment.

Question 10

Can I white-label reports for clients?

Accepted Answer

Yes. Pro and Agency include white-label client-facing reports, share links, and workflow-ready remediation sections.

Question 11

How do domain verification methods work?

Accepted Answer

You can verify ownership via DNS TXT record or file-based verification. Once verified, recurring scans and reporting are available for that domain.

Question 12

How should I interpret pass findings?

Accepted Answer

Pass findings indicate controls that were explicitly checked and found healthy. They are included for auditability but should not inflate issue counts.

Question 13

Can I run only teaser scans before purchasing?

Accepted Answer

Yes. Teaser scans are available publicly. Full scan depth, scheduling, white-label output, and cloud posture checks are unlocked by paid plans.

Question 14

Do you provide API access?

Accepted Answer

API access is available on Agency, including workflows for multi-client operations and larger delivery pipelines.

Question 15

Can ShieldReport automatically fix vulnerabilities?

Accepted Answer

Yes. For GitHub-connected repositories, ShieldReport can generate pull requests to fix common issues like missing security headers, robots.txt misconfigurations, and CSP policies. The auto-fix engine generates the exact code changes needed and opens a PR for your review.

Question 16

What compliance frameworks do you map findings to?

Accepted Answer

Every finding is automatically mapped to SOC 2, HIPAA, and ISO 27001 controls. You can export compliance reports as CSV or JSON from the Compliance Center in your dashboard, making auditor handover straightforward.

Question 17

How does credential leak detection work?

Accepted Answer

ShieldReport cross-references email addresses associated with your domain against the HaveIBeenPwned breach database. If employee credentials appear in known data breaches, we flag it as a high-severity finding with specific remediation steps (password resets, MFA enforcement).

Question 18

What is the IaC Scanner?

Accepted Answer

The Infrastructure-as-Code Scanner lets you upload docker-compose.yml, Kubernetes YAML, or Terraform files for pre-deployment security checks. It detects privileged containers, exposed ports, missing resource limits, and insecure configurations before they reach production.

Question 19

How does subdomain takeover monitoring work?

Accepted Answer

ShieldReport monitors your subdomains for CNAME records pointing to unclaimed services (expired S3 buckets, deprovisioned Heroku apps, abandoned Shopify stores). If a takeover is possible, we flag it immediately so you can claim or remove the DNS record.

Question 20

Can I integrate ShieldReport with Slack or CI/CD pipelines?

Accepted Answer

Yes. Use the Slack bot (/shield scan domain.com) to trigger scans directly from chat, with fix-ops buttons for one-click remediation. For CI/CD, our webhook endpoint fails GitHub Actions or other pipelines when critical findings are detected in staging URLs.

Question 21

What is the honeypot canary feature?

Accepted Answer

ShieldReport deploys a fake admin URL (/shield-admin) on your domain. If any IP accesses it, you receive an instant SMS, email, or webhook alert — catching attackers probing for admin panels in real time.

Question 22

Do you support multi-language reports?

Accepted Answer

Yes. Reports can be translated into 11+ languages including Spanish, French, German, Japanese, Korean, Chinese, and Arabic. This is especially useful for global teams or agencies serving international clients.

Question 23

What free tools are available without a paid plan?

Accepted Answer

We offer free tools for Security Header Checking, Sitemap Security Auditing, robots.txt Generation, Domain Health Scoring, Broken Link Scanning, Chrome Vitals + Security checks, and an ROI Calculator. Each has a dedicated page optimised for immediate use.

Question 24

How does the affiliate program work?

Accepted Answer

Share your unique referral link and earn 20% of every payment your referrals make — recurring monthly for as long as they are a customer. No caps, no limits, with a 90-day cookie window and monthly payouts via Stripe.

Operational answers for teams, agencies, and client delivery

Ready to validate your environment?

Operational answers for teams, agencies, and client delivery

Ready to validate your environment?