Passive Security Scan vs Penetration Test
Updated 2026-10-17
A passive scan looks at what your deployed site already serves to the public. A penetration test actively tries to break in, with permission. They answer different questions.
| Area | Passive scan (ShipGuard) | Penetration test |
|---|---|---|
| Permission needed | No (public data only) | Yes, written authorization |
| Finds | Leaked keys, exposed files, headers, schema exposure | Auth bypass, IDOR, injection, logic flaws |
| Reads your data | No | May, within scope |
| Time | Seconds | Days to weeks |
| Best for | Pre-launch hygiene, regressions | High-stakes launches, compliance |
Use both, at the right time
Run a passive scan on every deploy to catch the obvious, cheap-to-fix issues. Commission a pentest when you handle sensitive data or money at scale.
FAQ
Does a grade A mean my app is secure?
No. It means none of the passive checks failed. Authorization logic and server-side bugs need testing beyond a passive scan.
Is passive scanning legal?
ShipGuard only requests publicly served resources, like a browser would. Always follow local law and a site's terms; see our About page for our scanning ethics.
Check your deployed app in ~25 seconds
Free passive scan: leaked keys, Supabase exposure, public config files and headers.
Run a free scan