QuantumReadyTry the engine on something real
Three ways in. Paste a few lines of your own code and see what the rules find. Run the sample estate, which is a Java service, the container image built from it and a cloud account. Or step through the read only calls a cloud scan makes and watch the inventory build up. No account, no install. Pasted snippets are sent to our hosted scanner, processed in memory and not saved as reports. Use the offline runner for sensitive code.
Paste a snippet, see what we find
This runs the same detection rules the product ships, over a single file of text. Pick a language to load an example, change it however you like, and read the result. The text is read in memory and not stored, and nothing is executed.
Run the scanner over a whole product
Three samples that ship with the product, so the run is real and the cost is nothing. Choose which ones to include. Each one is scanned by the same code a customer scan uses.
Loading the samples...
What the scanner actually asks for
A live cloud scan uses the read only credentials already on the machine and makes the calls below, one at a time. Press start to read the prepared account, then step through the calls and watch the lines arrive. Every call is read only, and none of them can read a secret value, a key, or any application data.
What this demo is, and what it is not
| It is | It is not |
|---|---|
| The real engine. The archive is built and parsed by the same code, the detection rules are the same set the product ships, and the score comes from the same function. | A scan of your systems. The samples ship with the product, and a pasted snippet is read once and discarded. |
| A realistic picture of the three shapes that matter: what developers wrote, what was built and deployed, and what is protecting traffic today. | A measurement of our accuracy. Accuracy is on its own page, measured against a corpus with hand written answers. |
| A way to read a report before you create an account, including the inventory, the evidence level behind every line, and the first things to fix. | A compliance statement. Nothing here establishes CSA, MAS or any regulator's view of anything. |
When you are ready to point the same engine at your own code, the free scan covers public repositories and endpoints, and the offline scanner covers containers, build artifacts, hosts and cloud accounts without your source leaving your network.