7Registered assetsEach node is one asset
LIVING ATTACK SURFACE
Understand the risk before it becomes an incident.
Discover your attack surface, run authorized security testing through accepted runtimes, understand the evidence, and move from exposure to a verified fix. One connected view of your security work.
Web application2 findings · exampleAPI servicesVerifiedCloud infrastructureNeeds proofSandboxVerifiedThird partyVerifiedData store1 finding · exampleIdentityOn example path
Interactive example · Sample data
3Open findingsFrom sample records
2Affected assetsWith open findings
86%Ownership verified6 of 7 assets
Attack Surface OverviewCalculated from 7 sample assets
6/7
Ownership verified
1 awaiting proofVerified ownership6
Awaiting proof1
Open findings3
How an exposure could spread
- Web application
- Identity access
- Data store
An exposed web credential could let someone use an identity's permissions to reach stored data.
The orange route is a potential connection in this example, not a confirmed exploit.See the finding review checklistExplore the sampleCompare the findings before and after a verified fix.
Asset labels Example risk highlights
3 open findings across 2 assets. 1 potential path shown. One evidence-first workflow
Security work should end with proof, not another alert.
ScopeForge keeps scope, evidence, explanation, remediation and verification connected while preserving the authority boundaries between them.
01
Discover
Inventory the applications, APIs, repositories and services that belong to your workspace.
02
Validate
Prove control before remote testing and keep authorization separate from execution authority.
03
Explain
Turn deterministic evidence into context that a developer can understand and review.
04
Connect
Relate evidence and consequences without presenting inference as observed fact.
05
Prepare
Make the likely consequences and response steps visible before an incident happens.
06
Fix
Keep remediation work attached to the finding, its evidence and its ownership history.
07
Verify
Retest with fresh evidence and close the loop only when the risk is actually gone.
Automated security engine
Explore the platform From verified scope to bounded evidence.
ScopeForge's automated pentest loop does more than collect findings. It plans authorized security work, executes only through accepted runtimes, records coverage and reduces provider output into reviewable evidence.
Operational runtimes1Accepted for bounded execution
External validating2Prepared behind release gates
External enabled0Production external runtimes
Authorize
Bind every run to verified workspace scope before remote execution is considered.
Plan
Turn observations into bounded actions while policy rejects targets or capabilities outside authority.
Execute
Use accepted runtimes with server-owned network, request, resource and cancellation ceilings.
Reduce evidence
Persist normalized observations and explicit coverage instead of handing raw provider authority to the UI.
Capability is not permission.
The first-party HTTP runtime is operational today. ProjectDiscovery httpx and Nuclei are intentionally visible as validation-only and remain unavailable to production runs until their own containment, worker-routing and bounded canary gates pass.
Security model
Authority stays narrower than capability.
ScopeForge is designed so a powerful scanner does not automatically become permission to scan anything. Remote behavior stays attached to verified targets, closed request shapes and explicit authorization.
Read the open-source projectScope first
Workspace assets and proof of control establish the boundary before remote security workflows can run.
Evidence first
Findings remain attributable to deterministic scanner or runtime evidence rather than unexplained model inference.
Verify the fix
Remediation closes only through fresh trusted evidence and a reviewable lifecycle, not a status toggle alone.