Dynamic scanning for the attack surface your SAST misses.
5
Audit categories per scan
30+
Discrete security checks run
0
Pipeline changes required
100%
Read-only — no write access ever requested
SAST finds what's in your code. DAST finds what's exposed at runtime.
Static analysis sees what your developers wrote. Dynamic Application Security Testing sees what the internet sees. Misconfigurations, credential leakage, and protocol failures only emerge when your application is live — and traditional SCA doesn't cover them.
Five audit categories. Thirty-plus checks.
Each free DAST audit runs all five categories in sequence against your live domain, returning a finding-level report with severity classification and remediation guidance.
Robot-txt Security
Path and admin exposure
- Sensitive path disclosure — detect disallow entries that reveal internal route structure to crawlers
- Admin panel exposure — flag admin, dashboard, and internal tool paths surfaced in robots.txt
- Sitemap reference validation — verify sitemap.xml links resolve correctly without exposing unintended structure
- Sitemap reference validation — verify sitemap.xml links resolve correctly without exposing unintended structure
Mixed Content Analysis
8 HTTP-over-HTTPS checks
- HTTP scripts, stylesheets, images, and media loaded over unencrypted connections
- HTTP iframes, link anchors, CSS url() references, and object data attributes
- Each check returns element type, source URL, and blocking vs. passive classification per browser security spec
Exposed Sensitive Files
12 file types probed
- .env files, AWS credentials, SSH private keys, SSL/TLS private keys
- Git repository exposure (.git/config accessible), database backup files, compressed archives
- CI/CD configs, Docker/container configs, dependency manifests, development artifacts
- all checks use unauthenticated HTTP probes — exactly what an external attacker would attempt
Cookie Security
Set-Cookie header analysis
- Missing Secure flag — cookies transmittable over HTTP
- Missing HttpOnly flag — cookies accessible to JavaScript (XSS vector)
- Missing SameSite attribute — CSRF exposure without cross-origin restriction
- SameSite=None without Secure flag — cross-site cookie sent in plaintext
SSL/TLS Certificate Validation
Set-Cookie header analysis
- Missing Secure flag — cookies transmittable over HTTP
- Missing HttpOnly flag — cookies accessible to JavaScript (XSS vector)
- SameSite=None without Secure flag — cross-site cookie sent in plaintext
- SameSite=None without Secure flag — cross-site cookie sent in plaintext
TripleKey DAST audits are available at no cost for any domain you control. Results are returned as a structured finding report — exportable for inclusion in HIPAA risk assessments, SOC 2 evidence, or BAA reviews. Continuous scheduled scanning is available in TripleKey Pro.
Out-of-pipeline.
Read-only. by design.
TripleKey's DAST scans from the same architectural position as a real attacker — external, unauthenticated, and entirely outside your CI/CD pipeline. No agents, no webhooks, no YAML edits.
DAST probes your live application via standard HTTP. No source code access, no CI/CD permissions, no write access of any kind requested at any stage.
.png)
No agent installation. No pipeline YAML modification. No container sidecar. Submit a domain — receive findings. Engineering time required: none.
All finding reports are formatted for HIPAA risk assessment inclusion and BAA review — exportable to PDF, JSON, or your existing GRC workflow.
Your application, seen through the eyes of an attacker.
Free to run. Five minutes to start.
74%
of codebases contain high risk vulnerabilities
~40%
increase in supply chain breaches in two years
6+ yrs
oldest unpatched issue found in a TripleKey onboarding scan
$0
cost to run your first full audit
A security checkup for your software
from the outside looking in.
Files that shouldn't be public
AWS credentials, private keys, database backups, and configuration files left accidentally accessible over the internet. We check for all of them — the way an attacker would.
.png)
Login and session vulnerabilities
Cookie security flags that leave user sessions exposed to interception or hijacking. Missing in one header = a real risk to every user who logs into your platform.
.png)
Expired or misconfigured SSL
An expired certificate is a visible trust failure — to your users, to health system procurement teams, and to HIPAA auditors. We catch it before they do.
Sensitive paths left exposed
Admin panels, internal dashboards, and private API routes accidentally published in ways that help attackers map your application before they probe it.
Mixed security and non-security content
Encrypted pages loading unencrypted resources — a browser red flag that undermines HTTPS protection and triggers security warnings for users and reviewers alike.
Audit-ready results, not raw data
Every finding is described in plain language with a severity level and a clear remediation path. Export directly to PDF for your next HIPAA risk assessment or BAA review.
Enterprise security reviews are finding these issues. You should find them first.
What security reviewers look for
Certificate status, exposed credentials, cookie security headers, unprotected admin paths, and mixed content are standard items in enterprise security questionnaires and penetration test scopes — the same categories we scan.
What a finding costs you
A single critical finding — an accessible .env file, an expired certificate, an exposed admin panel — can extend a deal timeline by weeks or trigger a formal remediation requirement before contract signature.
Three steps.
No IT ticket required.
TripleKey External runs entirely from the outside of your application — no access to your code, no changes to your systems, no agent to install.
Enter the URL of your live application. That's it. No credentials, no technical setup, no integration work. Anyone on your team can initiate this.
Join the Waitlist
TripleKey probes your application the same way a security auditor or attacker would — checking for exposed files, certificate issues, cookie settings, and insecure content.
Join the Waitlist
Every finding is explained in plain language with its severity and what to do about it. Export to PDF for your next audit, risk review, or vendor security questionnaire.
Join the Waitlist
