New: IaC · SAST · Cloud Audit · Multi-User Teams
Four new capability areas — added without changing existing DAST, API, container, SCA, or host scanning workflows. Shift left with IaC and SAST, extend right with cloud auditing, and collaborate with your team.
🏗️
Starter+
IaC Scanning
Terraform · CloudFormation · Kubernetes YAML · ARM Templates
Catch infrastructure misconfigurations before they reach production. VulnProScan runs Checkov against your infrastructure-as-code definitions and surfaces security risks with severity ratings and remediation guidance — directly in your dashboard or CI pipeline.
Supported frameworksTerraform, CloudFormation, Kubernetes YAML, ARM templates, Dockerfiles, Serverless Framework.
What it findsPublicly accessible S3 buckets, IAM wildcard permissions, missing encryption at rest/in transit, insecure security group rules, over-permissive RBAC in K8s manifests.
Tier breakdownStarter includes IaC lite (Terraform + CloudFormation). Pro+ enables the full framework set. Business+ adds drift detection — compare IaC definitions against live cloud state.
CI/CD integrationPOST to /api/ci/modular-scan-webhook with your ZIP artifact. Returns findings JSON and a pass/fail status code — gate deployments on security results.
🔬
Pro+
SAST — Static Code Analysis
JavaScript · TypeScript · Python · Go · OWASP Top 10 · CWE
Surface vulnerabilities in your source code before deployment. Semgrep OWASP pack analysis identifies injection flaws, hardcoded secrets, insecure deserialization, and more — with code-level fix guidance mapped to CWE identifiers so developers know exactly what to change.
LanguagesJavaScript, TypeScript, Python, Go. Upload a ZIP of your source or connect via the CI webhook.
Rule packSemgrep p/owasp-top-ten — covers injection (A03), insecure design patterns (A04), security misconfiguration (A05), and more.
Per-finding outputFile path, line number, CWE ID, OWASP category, severity, and an inline code-level fix recommendation.
ROITeams that catch injection and authentication flaws in code review instead of production spend 6× less on remediation (NIST estimate). SAST is the fastest payback scan type.
☁️
Pro+
Cloud Configuration Audit
AWS · Azure · GCP · IAM · S3 · Policies · Runtime Registries
Validate your live cloud environment against security best practices. Prowler auditing connects to AWS, Azure, and GCP to check IAM configurations, storage bucket policies, network rules, logging, and encryption — finding the gaps attackers look for.
Cloud providersAWS (IAM, S3, VPC, CloudTrail, RDS, Lambda), Azure, and GCP configuration checks.
What it auditsOver-permissive IAM roles, public-access storage buckets, missing CloudTrail logging, disabled MFA enforcement, insecure security groups, unencrypted snapshots.
Runtime registriesAudits ECR, ACR, and GCR configuration alongside your container image CVE scanning for unified cloud coverage.
Business+ drift detectionCompare your IaC definitions against live cloud state. Surface resources that were deployed outside Terraform/CloudFormation and identify configuration drift before it becomes a breach.
👥
Business+
Multi-User Teams, Enterprise RBAC & Governance
Admin / Security Analyst / Viewer · SCIM + SSO/SAML · Audit Logs
Security is a team sport. VulnProScan Business introduces shared team workspaces with three-tier RBAC enforced at the API level. Enterprise extends to unlimited teams with SSO/SAML identity integration, SCIM directory sync, immutable audit logs, and compliance snapshot automation.
Three-tier RBACAdmin (full control), Security Analyst (scans, findings, cloud posture, compliance reports), and Viewer (read-only). Permissions enforced at the API level — not just in the UI.
SSO/SAML 2.0 + SCIM provisioningSP-initiated SAML 2.0 with JIT user provisioning. SCIM 2.0 (RFC 7644) for automated user and group management — compatible with Okta, Azure AD, and any compliant IdP. Deprovisioned users are automatically blocked.
Immutable audit logsEvery scan, sign-in, team change, finding update, and compliance snapshot is recorded with timestamp, user, IP, and outcome. Exportable for SOC 2 and ISO 27001 audit evidence packages.
Business vs. EnterpriseBusiness: up to 10 users with RBAC and compliance reports. Enterprise: unlimited teams, SSO/SAML, SCIM, audit logs, SLA tracking, finding governance, cloud drift detection, and procurement-ready agreements.