A domain name. Maphra works from the outside in, so it needs no agent, no credential into your estate and no network access. Discovery begins from public data the same way an attacker would begin.
How is Maphra different from a vulnerability scanner?
A scanner tests a list of assets you give it. Maphra finds the assets first — including the ones nobody remembered — attributes them to your organisation, then analyses them. The discovery step is the product.
Does Maphra attack our systems?
Active validation runs only inside an explicit scope boundary you define, and the scope gate prevents active checks from reaching third-party hosts that merely appear in your surface.
How does Maphra handle findings that are not real?
Every finding carries the evidence that produced it, and findings are deduplicated across scans and tracked through new, reopened and fixed states rather than re-reported each run.
About AppSecD
Does AppSecD replace our existing scanners?
It consolidates them. SAST, DAST, SCA, secrets, IaC, container, Kubernetes and API security all run from one platform against one deduplicated finding model, so the same vulnerability is not tracked three times in three tools.
How does it avoid burying developers in false positives?
Two ways. Reachability analysis determines whether a vulnerable path can actually be reached before anything is raised, and an AI triage layer labels likely false positives — with the label itself tracked, so triage quality is measurable.
Where does it fit in our pipeline?
It triggers on webhooks, scheduled runs, CI, ZIP upload or manually, and it gates pull requests and commits by policy. Developers also get results inside VS Code, Cursor, Windsurf and JetBrains before they push.
Can a developer close their own finding?
Not where you do not want them to. The lifecycle supports maker-checker approval, so a finding marked fixed or false-positive can require a second person to confirm it.
About both
What is the difference between the two products?
Maphra works outside-in: What can an attacker reach without any credentials? AppSecD works inside-out: What are we shipping into production right now? They overlap very little and most teams run both.
Can we run both, or do we have to choose?
Both. They answer different questions and overlap very little — Maphra looks at what is reachable from outside with no credentials, AppSecD looks at what you are about to ship. Most teams run both.
Do we need to install an agent?
Not for Maphra: it is agentless and starts from a domain name, with no credentials into your estate. AppSecD connects to GitHub or GitLab rather than installing on your infrastructure.
How often does scanning run?
Maphra runs continuously, on a schedule and on demand. AppSecD runs against commits and pull requests, so it reports at the point the code changes.
Which source control and IDEs does AppSecD work with?
GitHub and GitLab, with pull request and commit gating, plus VS Code, Cursor, Windsurf and JetBrains on the developer side. It is also OpenAPI documented across roughly 860 API endpoints.
Does Maphra attack systems that are not ours?
No. Maphra works from public information by default, and active validation runs only inside an explicit scope boundary you define.
Are the free tools on this site scanning my organisation?
The SSL/TLS checker and the DNS checker perform live lookups against whatever domain you enter. The exposure checker, email security, deepfake analyser and advanced scanner pages are interactive demonstrations of what a check involves, not live assessments of your estate.
Do you provide penetration testing as well as the platforms?
Yes. DedSec Technologies LLP provides scoped, manual penetration testing and advisory services alongside both platforms, for the judgement work automated scanning cannot do.
Who builds them?
DedSec Technologies LLP. Maphra by DedSec runs at https://maphra.dedsecops.com and Navigator AppSecD runs at https://appsecd.com.
How do we get started?
Maphra needs a domain name and nothing else, so the quickest first step is a walkthrough against an estate you already worry about. Email contact@dedsecops.com or use the contact page.