Ostorlab documentation
Guides for scanning mobile apps, web apps and APIs, source code and networks, mapping your attack surface, and remediating what Ostorlab finds.
$ ostorlab --api-key="$OSTORLAB_KEY" ci-scan run \
--scan-profile=full_scan \
--break-on-risk-rating=high \
android-apk app-release.apk
✓ Scan created
⋯ Static, dynamic and backend analysis
✓ Scan done. Risk rating: MEDIUM
✓ Build passes (threshold: HIGH)Start here
Four goals. Each lists the pages to open, in order.
Mobile, web, API, code or network
Create an account, open the dashboard and start your first scan.
Getting Started
Compare scan profiles by the assets they cover and what they test.
Scanning › Scan Profiles
Find the app in a store by name or package, then pick a Fast or Full scan.
Scanning › Run a scan
Enter a URL or domain, pick a profile and submit. Add credentials to scan behind a login.
Scanning › Run a scan
Results, tickets and policies
Tell confirmed findings from potential ones, and see the coverage behind each.
Scanning › Report
Assign vulnerabilities and follow their tickets through to a fix.
Policies & Remediation › Ticketing
Set a schedule for fixing vulnerabilities, based on their risk rating.
Policies & Remediation › Ticketing
CI/CD, the API and AI assistants
Add Ostorlab to GitHub, GitLab, Jenkins and more, and fail the build on risky findings.
Integrations & API › CI/CD
Give it a name and an expiry date, then use it in scripts and CI jobs.
Integrations & API › API
Let an assistant work with your scans, vulnerabilities and tickets.
Integrations & API › API
Create scans, follow their progress and list vulnerabilities.
Integrations & API › API
Users, sign-in, plans and keys
Add people to your organisation from the settings menu.
Organisation › Users
The whole platform
Five stages take an asset from unknown to fixed. Administration sits under all of them.
Find what you own
Attack SurfaceTest it
ScanningRead and rank findings
Assign, patch, verify
Policies & RemediationRepeat on every build
Under every stage
Organisations, users and roles, sign-in, plans and tokens, API keys, scanners and audit logs.
Around all of it
Security guides and checklists, the Knowledge Base, and how Ostorlab handles your data.
Browse
Create an account, tour the dashboard and run your first scan.
Ask the assistant about the platform, your scans and your vulnerabilities.
Pick a scan profile, run it on an app, source code or network, and read the report.
Discover what you own, keep the inventory current and watch it for change.
Work tickets, group them in streams, and set the policies that decide what gets fixed first.
Create your organisation, add users and roles, and manage settings and access.
Add a plan, or transfer plans between organisations.
Security checklists, mobile app security guides, privacy, and the Knowledge Base.
Developers
Automate scanning and triage from your own code, or let an AI assistant work with your findings directly.
The full platform surface: create scans, follow their progress, pull tickets and download reports.
$ curl -X POST https://api.ostorlab.co/apis/graphql_token/ \
-H "X-Api-Key: $OSTORLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "{ scans { scans { id title progress } } }"}'Typed tools that AI assistants discover and call on their own, for scans, vulnerabilities, tickets and assets.
$ claude mcp add --transport http ostorlab \
https://api.ostorlab.co/apis/mcp/YOUR_API_KEY/Integrations
Add Ostorlab to your CI/CD pipeline, fail builds on risky findings, and sync tickets with Jira, Linear or ServiceNow.
All integrations
Watch the platform walkthrough