Question 1

Why do I need to verify ownership of my app?

Accepted Answer

Security Scan sends real attack traffic — actual injection payloads, crafted requests designed to test access control, probes that look exactly like what an attacker would send. That's what makes it accurate. But it also means we need to be certain you're authorized to test the target. Ownership verification is how we confirm that.

Question 2

How does the ownership verification work?

Accepted Answer

You serve a short plain-text file from your app at a specific path. Only someone with access to the app's codebase can do that, which is all the confirmation we need. We provide a prompt you can paste directly into your coding agent to set it up — it takes about a minute.

Question 3

What vulnerability classes does Security Scan cover?

Accepted Answer

Injection flaws (SQL injection, XSS, command injection), broken access control, weak or bypassable authentication, insecure API behavior, Insecure Direct Object Reference (IDOR), and cross-tenant data exposure. These are the classes most commonly introduced by AI coding agents — not because the models are reckless, but because they optimize for functionality and don't apply the security intuition that comes from experience.

Question 4

Does Security Scan send real attack traffic to my app?

Accepted Answer

Yes. That's what makes it accurate. Security Scan doesn't guess from source code — it drives your running app the way an attacker would. It sends actual payloads, crafts requests that test your access control logic, and confirms that vulnerabilities are real and exploitable before it reports them. This is why ownership verification is required.

Question 5

Can I run Security Scan against a staging environment?

Accepted Answer

Yes, and we recommend it. Staging is the ideal target — it's a realistic environment without production data at risk. Ownership verification applies to whichever environment you're testing, so you'll verify that domain specifically.

Question 6

How is this different from a tool like Burp Suite or OWASP ZAP?

Accepted Answer

Burp Suite and ZAP are tools for security engineers — they require expertise to configure, interpret, and act on. Security Scan is autonomous: it explores your app on its own, interprets what it finds in the context of how your app is supposed to work, and writes findings your coding agent can fix directly. No security background required.

Question 7

Does Security Scan replace a manual pen test?

Accepted Answer

For most AI-built apps, it gives you more coverage than you'd otherwise have — at a fraction of the cost and on a continuous basis. A manual pen test from a qualified firm goes deeper in some areas (particularly business logic and social engineering), but it runs once a year if you're lucky, costs tens of thousands of dollars, and takes weeks to schedule. Security Scan runs on every build.

Question 8

How much does Security Scan cost?

Accepted Answer

Security Scan runs are billed the same way as standard QA passes — credits consumed depend on the complexity of your app, not the scan type. There's a free tier to try it before you decide.   See pricing .

Replay QA now does penetration testing.

Bug reports that read like a real pen test finding

AI coding agents write insecure code at scale.

An agentic testing harness that works like a swarm of QA testers

Explore

Test & Record

Investigate & Report

It runs where your team already works

Connect a repo, then forget it

Set your testing schedule

Test across every environment

Every pull request gets checked

Bugs land in your tracker

Everyone on the team can read it

Up and running in minutes

Connect the repo or drop in a URL

Verify you own the app

Enable Security Scan

Findings land in your tracker

Frequently asked questions

Find the vulnerabilities before your users do.