Active Scanning

Deep vulnerability testing for SQL injection, XSS, and open redirects. Requires a paid plan.

Active scans actively probe your site for vulnerabilities by sending attack payloads to detected endpoints. Only run these on sites you own or have permission to test.

#Requirements

Active scanning requires a paid plan (Starter, Pro, or Max). The active scanner runs in an isolated environment on Vergate's infrastructure.

#Scan Profiles

Profile	Duration	What It Does
Baseline	5-20s	Crawling + passive analysis only. No active testing.
Fast	1-5 min	Crawling + active testing (5 min max). Good for CI/CD.
Thorough	5-30 min	Full crawl + exhaustive active testing (30 min max). Most comprehensive.

#API Usage

Trigger an active scan

POST /api/v1/scan/{scan_id}/active
Authorization: Bearer pk_...

{
  "profile": "fast"
}

Active scans run as background jobs. You can poll the status:

Check scan status

GET /api/v1/scan/{scan_id}
Authorization: Bearer pk_...

{
  "status": "completed",
  "active_status": "completed",
  "findings_count": 24
}

#Two-Phase Scan

Active scans follow a two-phase flow:

1. Passive Complete — The passive scan finishes first, giving you instant findings.
2. Active — The active scan then runs, adding deeper vulnerability findings.

Note. You can view passive results immediately while the active scan is still running. Results are updated as the active scan discovers new findings.

#OpenAPI Discovery

If your site exposes an OpenAPI spec (e.g., /openapi.yaml), the scanner will parse it and inject real API endpoints for testing. This ensures the scanner tests your actual API endpoints, not just what the crawler discovers.

#Safety

Each active scan runs in an isolated one-shot environment that is destroyed after the scan. No state leaks between scans.

Warning. Active scans send real attack payloads. Never scan production sites without understanding the risks. Use baseline scans for production, fast/thorough for staging.