Vulnerability Check

Automatically detect security issues in the URLs registered under your project. As AI coding tools become more prevalent and web application security risks increase, this feature lets you run security checks as part of your development cycle with ease.

Key Features

• Automatically runs 14 security checks asynchronously
• Each result includes bilingual (Japanese/English) title, reason, and remediation guidance
• Real-time status updates from scan start to completion (typically a few seconds to tens of seconds)
• Export reports as Markdown or CSV, or print/save as PDF
• AI agents can access reports via MCP tools

Check Items

Domain Verification

For safety, Vulnerability Check can only be run against domains you have proven ownership of. To prevent scans from being run against unauthorized third-party domains, every target registration, target update, and scan run checks whether the target URL's domain has been verified. This check also applies retroactively to targets registered before this feature was introduced, so if a scan is unexpectedly blocked, check the domain's verification status first.

1. Register a domain — Open Verified Domains from the top right of the target list, click Add Domain, and enter a domain name (e.g. example.com). If you enter a full URL, only the hostname is extracted automatically.

2. Add a DNS TXT record — After registering, a TXT record like the one below is displayed. Add it in your DNS provider's management console.

   Field	Value
   Type	TXT
   Name	_katatan-challenge.<your domain>
   Value	katatan-domain-verify=<issued token>

3. Click "Verify Now" — After configuring DNS, click Verify Now on the list screen to get an immediate result. DNS propagation can take anywhere from a few minutes to a few hours, so if verification fails right away, double-check your record and try again later.

4. The domain becomes available for scanning — Once verified, the domain and its subdomains (e.g. app.example.com) become available for target registration and scanning.

Domain verification is managed per project. Even within the same workspace, you'll need to register and verify the same domain again for each other project you want to scan it from.

How to Use

1. Register a target — Select Vulnerability Check from the project sidebar, then click + New Scan Target and enter a name and URL (the target domain must already be verified).
2. Run a scan — Click the Start Scan icon on the target row. The scan runs asynchronously and the status updates automatically.
3. Review the report — After the scan completes, click the target name to see the report list. Click Details to view findings, reasons, and remediation steps for each check item.
4. (Advanced) Scan authenticated sites — Configure custom HTTP headers in the target's Settings screen. Sensitive values such as API tokens can be stored as encrypted Secrets and referenced in header values.

Permissions