Which module you need depends on what you are responsible for. Most teams start with one and add the others when the first one has paid for itself.
What it sees
Your live site, app and API as an outsider sees them, plus the forgotten subdomains and services attached to them.
What it detects
Injection, broken access control, misconfiguration, weak headers and cookies, exposed admin surfaces and TLS problems.
Who it is for
Owners who must not be breached, and the developer who gets the call when something is.
Evidence produced
Safe request/response pairs, affected routes, scanner and rule identity, and retest history.
What it sees
Repositories you have authorized — source, lockfiles, infrastructure as code and commit history.
What it detects
Unsafe patterns, vulnerable dependencies with reachability, committed secrets and permissive cloud configuration.
Who it is for
The people who can actually merge the fix.
Evidence produced
File and line, data flow, detector and rule, the introducing commit and a proposed patch.
What it sees
Pages rendered in real browsers at real sizes, with the DOM, accessibility tree, console and network captured.
What it detects
Visual regressions, clipping, overlap and overflow, missing assets, JS errors, failed requests, contrast and labelling failures.
Who it is for
Anyone shipping frontend changes, and agencies answering for a client’s site.
Evidence produced
Before/after screenshots, diff regions, selector and computed style, console log and baseline history.
One workspace
One login, one bill, one set of roles.
Correlated findings
A runtime problem links to the code that caused it.
Shared reports
Executive, technical, delta and client-facing.
Agency support
Client workspaces and white-label output.
AI explanation
Labelled, grounded in evidence, never the proof itself.