Assets
Everything the application loaded, stored and readable.
Documents, code, styles, media and data, all stored and readable. As resources load, each response body is hashed and validated against the Single Source of Truth registry, so known code is identified by software, version, vendor and provenance, and anything unrecognized stands out immediately.
SCVue classifies every response into six kinds and gives each its own report. All six share one pattern: what was loaded, from where, how big it was, and a click that opens the stored content itself. That is where shadow dependencies surface, because a file arrives looking ordinary until you read what the engine found inside it.
Integrated Reports
-
Documents (HTML)
The pages themselves, with the markup that was actually delivered. It is how you confirm what a page contained at the moment of capture, independent of what it looks like today.
-
Code
Every executable script, and the most security-relevant asset report in the product. Each script carries what the code analysis found in it, and one finding deserves emphasis: a script that fetches remote content and executes it means your site's behavior is being decided somewhere else, by a party who can change it without telling you. It is the mechanism behind most third-party supply chain compromises.
-
Code Resources
Supporting files that accompany code: compiled modules, source maps, manifests. Listed separately so the Code report stays focused on things that actually execute.
-
Styles
Stylesheets, frequently overlooked as a supply chain surface despite being loaded from third parties as often as scripts are, and despite being able to load further resources of their own.
-
Media
Images, video and audio, and the tracking hidden inside them. A one-pixel invisible image is one of the oldest and still most common tracking techniques on the web, and it appears here as a media file, flagged for what it is.
-
Data
Structured data exchanges, the machine-to-machine conversations behind a modern page. This is where you find what an application is actually asking for and receiving from its suppliers, as opposed to what it displays.
Stored once, no matter how often it appears
Identical files are kept a single time however many times they occur across a capture, which is what keeps a large capture manageable without discarding anything.
One capture is enough to start
Capture a session in the browser, import it, and read what comes back. A free community account is available immediately.