Decloak.dev

Most scanners check a fixed list of things and stop. Decloak's paid tiers deploy an AI security agent that works more like an investigator than a checklist.

Once the initial scan surfaces findings, the agent reads each one and decides what to look at next. If it spots an exposed source map, it fetches the file and reconstructs the original source code to check for hardcoded secrets. If it finds a Google Tag Manager container firing to an unrecognised domain, it cross-references that domain against WHOIS and threat intelligence data, flagging anything registered suspiciously recently. It checks DNS records and TLS certificate health, enumerates subdomains for forgotten staging environments, and writes specific remediation guidance for every finding it confirms, all while showing its reasoning at each step rather than returning a black-box report.

This is the difference between a single-page scan and full-site coverage. The Starter tier (£29/month) covers up to 50 pages per scan with DNS/SSL analysis, PDF evidence export, and scheduled recurring scans. Pro (£79/month) extends to 200 pages, adds ISO 27001/SOC2 control mapping and team access. Enterprise (£99/month) adds Active Security Testing (DAST): safe, non-destructive active probes including forced browsing, CORS misconfiguration checks, and authenticated scans behind a real login, rolled up into an independent Active Testing Score.

Built for teams that need more than a snapshot, an investigation that keeps digging until the picture is complete.