Platform quickstart

Try a public light scan

Enter a public URL from the VICE home page to get an initial view of the exposed web surface. A light scan is intentionally bounded and does not require an account or proof of domain ownership.

Use this result to confirm reachability and obvious public signals. It is not a substitute for a verified full audit or a source review.

Sign in with Webba ID

VICE delegates sign-in to Webba ID. After the callback, Platform uses an account-scoped backend session for domains, audits, findings, integrations, notifications, and billing.

Plan, quota, ownership, and verification decisions are checked by the server. A label or claim in the browser cannot grant additional access.

Create a domain workspace

Add the canonical hostname for the application without a path. Keep staging and production in separate workspaces when they have different deployments or trust boundaries.

• Audits and their live status.
• Open, solved, and historical findings.
• Reports, score badge, schedules, modules, and integrations.
• Verification state and domain settings.

Verify the domain

VICE provides a unique DNS TXT record. Publish its exact host and value in the authoritative zone, wait for propagation, then retry verification from the workspace.

• Use the zone that is authoritative for the exact hostname.
• Do not add manual quotes unless the DNS provider requires them.
• Allow time for cached negative DNS responses to expire.

_vice.app.example.com  TXT  vice-verification=<unique-token>

Launch a verified audit

Choose Full for the managed default or Custom to select modules. Starting the audit is the deliberate authorization for the probes included in that profile. You can follow progress live or return to the audit history later.