Verdicts
- Clean: every engine ran and found nothing of medium severity or higher.
- Issues found: no malware, but security problems that should be fixed, for example a leaked key, a vulnerable dependency or a missing security header.
- Threat: at least one engine found malware, such as an antivirus signature, a YARA malware rule or a web-shell pattern.
- Failed: the scan could not be completed. The report says why, for example a time or size limit.
Severities
From most to least urgent: critical, high, medium, low and info. Start with critical and high findings. Info findings are context, not problems.
Engines
- ClamAV: antivirus signatures, updated regularly.
- YARA: curated malware rule sets; PHP rules are applied only to PHP files to avoid false alarms.
- secscan heuristics: insecure code patterns (Python, PHP, JavaScript and more), leaked secrets (masked in the report), web malware such as skimmers, miners and obfuscated loaders, and outdated JavaScript libraries.
- OSV vulnerability database: known vulnerabilities in your dependencies (npm, PyPI, Go, crates.io, Packagist and more).
- OWASP ZAP (website scans): see Scanning websites with OWASP ZAP.
The forensic report
For each scan you get the MD5 and SHA-256 of the upload, the complete file inventory with hashes, file types and languages, findings grouped by file with line numbers and code excerpts, timings and notes. Download full report (JSON) gives you everything in machine-readable form.
Is it a false positive?
Automated tools make mistakes. If you believe a finding is wrong, read False positives, feedback and feature requests.