Compliance / Security
Scan643
AvailableScan643 is a web application that points a headless browser at payment pages and produces script-inventory evidence around PCI DSS 4.0 Requirement 6.4.3 — discovery, interception, classification, and a signed trail. It is tooling, not a QSA stamp.
A buyer gets a working scan product: URL in, Playwright deep scan, findings with risk labels, optional monitors, and pay-to-reveal report packaging already designed.
Build vs buy
Avoid standing up headless scanning, SSRF-safe URL handling, Stripe report unlock, scan history, and PDF/hash evidence from a blank compliance repo.
Differentiation
Narrow and opinionated: 6.4.3-style script inventory and initiator chains, not a generic website vulnerability scanner.
Best fit
PCI consultants, ecommerce security vendors, and agencies that already talk to high-risk merchants about checkout pages.
Evidence
Screenshots are the working interface — not a pitch deck. Click to enlarge.
Click any image to open the gallery · 3 images. Use arrow keys in the lightbox.
Why it matters
Payment pages accumulate third-party scripts. Requirement 6.4.3 expects an inventory and a change story. Without a dedicated scanner, that work is screenshots, DevTools, and hope.
What it does
Point Scan643 at a payment URL. The system runs a headless scan, records scripts and network activity, classifies findings, and retains logs plus evidence artifacts. Operators can whitelist authorized scripts and attach monitors.
Operational advantage
Replaces the custom engineering of payment-page script discovery, initiator-chain analysis, and evidence export. Consultants can sell per-scan or monitor work instead of writing one-off Playwright scripts for each merchant.
Build vs buy
Avoid standing up headless scanning, SSRF-safe URL handling, Stripe report unlock, scan history, and PDF/hash evidence from a blank compliance repo.
Interface advantage
Operators enter a URL and watch live scan logs. Detail sits behind an optional paid reveal. Authorized-script whitelist and monitor UI keep the product in an operator’s hands, not a researcher’s notebook.
What makes this different
Narrow and opinionated: 6.4.3-style script inventory and initiator chains, not a generic website vulnerability scanner.
Where this gets used
- Payment-page script inventory before a PCI assessment
- Change detection when a merchant adds a new tag manager or chat widget
- Evidence pack for an underwriter who asked what runs on checkout
Commercial paths
- SaaS freemium: free scan signal, paid report detail
- Agency or PCI-consultant SKU billed per scan or per monitor
- White-label the scanner under a security vendor brand
Best buyer fit
PCI consultants, ecommerce security vendors, and agencies that already talk to high-risk merchants about checkout pages.
Current status
Available for commercial source licensing or exclusive acquisition. Core scan and report packaging are in place; buyer should review hardening items during diligence.
Notes
Does not formally certify PCI compliance. Buyer should validate completeness against their target 6.4.3 workflow.
Key capabilities
- Headless-browser payment-page scanning
- Dynamic script discovery and network interception
- Initiator-chain analysis
- Findings with LOW→CRITICAL classification
- Scan logs and history for authenticated operators
- Evidence / signature workflow (hash + PDF path)
- Optional scheduled monitors and email alerts
Related inventory
Compliance / Ecommerce
PrepScan
Scan high-risk merchant sites against a large processor and regulatory rule set, then hand the operator a findings workflow instead of a pile of opinions.
Compliance / Data
Bans Compliance Network
Publish regulated-product legal status across a network of properties — or buy the Sentinel Hub that operates them together.
Individual property acquisition · Commercial source license · Complete network/bundle acquisition
Make Offer
View asset