The full capability list, built around the way OutSystems teams actually work — release cycles, modules, and PMs who need a plain-English summary. The landing page shows the headline six; this is all of them.
Flags screens left open to Anonymous or stuck on generic Registered — the access-control gaps that turn into data leaks.
Spots endpoints that take internal IDs without ownership checks — the pattern attackers use to enumerate other users' records.
Server-action names are scored against curated Dangerous and Suspicious pattern sets — code that always deserves a second pair of eyes.
CSP gaps, cookie-flag issues, missing security headers. Each finding links to a guide explaining the why and the fix.
Compare two scans. Get a dev-facing changelog and a PM-friendly summary — engineers and stakeholders read the same release notes.
Per-release diffing surfaces only what wasn't flagged last time and isn't already triaged. No alert fatigue.
Mark findings fixed, ignored, or false positive. Triage state is shared and silences resolved items on future scans.
Send a 7-day, scoped read-only link to one specific report. No login needed for the recipient.
Custom headers (Akamai, Cloudflare bypass) and proxy-country selection — for apps behind firewalls or geo-restricted.
Visual graph of which modules consume which — three layouts (radial, force, hierarchical), full-viewport canvas, exportable PNG. Spot the high-fan-in modules that quietly underpin half the factory.
One page per app showing dangerous-finding count over every scan, severity-ratio over time, scan cadence, and a clear health verdict. Catches regressions release-over-release without re-reading every report.
Put an app on a schedule — anywhere from every 15 minutes to weekly — and AppScan re-probes it on its own. Newly-critical findings raise an in-app badge and go out by email or to a webhook (Slack, Teams, or your CI), once per report, so nobody has to remember to check.
One page per release that bundles the findings that matter for a go/no-go call with a recorded review verdict — approved, approved with conditions, or blocked — and exports as a PDF you can attach to the change record.
Pin a proxy country or custom header per app, cap its request rate, choose the test identities used for authorization checks, and decide whether every sweep runs full or incremental. Set once, applied on every scan of that app.
Upload an .apk or .aab and AppScan analyses the bundle itself. Where an app has both a package and a live URL scan, a merged view combines the two perspectives and a delta view shows what exists in one but not the other.