Decloak
- Active testing requires Enterprise and authorization
- False positives and reporting ambiguity are documented
- Compliance mapping is not certification
Framework mapping supports an audit; it does not perform one
The current founder update maps findings to several frameworks and explicitly says the mapping is indicative, not a certified audit. A reachable web scan cannot establish every organizational process, contractual requirement or development practice needed for compliance.
For a vendor questionnaire, attach the relevant findings and their dates rather than promising that purchasing the scanner satisfies a framework. A clean scan does not establish business-logic correctness, complete access control or future security after code changes.
The vendor terms also warn that free-tier reports may be accessible to anyone holding the report link. Avoid putting credentials into submitted URLs and confirm report-sharing behavior for the paid workflow before collecting client evidence. A scan does not establish legal or regulatory compliance.
Compare ongoing evidence work, not just scan counts
The offer requires activation within sixty days, allows movement among three tiers and says no code stacking. Its lifetime wording concerns the life of the granted tier under the vendor terms. The offer does not define a paid capacity pack beyond the daily/page limits, so do not assume one can be purchased later.
Vibe App Scanner is worth comparing when the priority is actionable findings for an AI-built app and separate code-repository analysis. Its monthly scan pools, repository beta scope and API tier gates differ materially from Decloak’s daily per-domain model.
For an early non-sensitive experiment, a free scan can help inspect the report style. A business with a contractual penetration-testing requirement should select a qualified assessment for that requirement. Automated scanning can support recurring verification without being the entire assurance process.
See all Decloak tier guidance
