How MapperPlus works.
Getting started
MapperPlus runs in the browser. There is no CLI and no agent to install. A workspace, such as Production · Team, holds your domains, sources, and findings.
- 01Add your domains. Start with the apex domains you own. Hosts and subdomains are found from there.
- 02Turn on sources. Open Settings and switch on the integrations you use. Each one is a single switch.
- 03Review the map. Apex domains, live hosts, subdomains, IP prefixes, and exposed ports fill in on the overview.
- 04Work the findings. Exposures, secrets, and pentest results open as findings with severity and an owner.
Sources and integrations
Sources feed the map. Code hosts and queues receive the work. All of them are switches in Settings, and a finding always names the source it came from.
- Cloudflare
- Zones, DNS records, and the hosts behind them
- Shodan
- Open ports and the services answering on them
- SecurityTrails
- Subdomains and historical DNS
- VirusTotal
- Related infrastructure and reputation
- Xleak.io
- Leaked credentials and stealer logs
- GitHub, GitLab, Bitbucket
- Code fixed for you, opened as a merge request
- HackerOne, Bugcrowd
- Researcher report intake
- Jira, Linear
- Tickets and issues from findings
- PagerDuty
- Pages when the severity cannot wait
Findings
Everything MapperPlus reports is a finding: a new subdomain, an exposed admin port, a hardcoded key in a public script, or an issue reproduced by a pentest. Each one carries the same fields.
- ID
- MP-1842
- Severity
- Set from what reproduces, not from a scanner label
- Asset
- The host, endpoint, or script URL
- Source
- The integration or test that produced it
- Owner
- The team the asset belongs to
- Status
- Where it stands in the pipeline
Remediation pipeline
Every finding moves through the same five stages.
- Discovered
- The finding opens from a source, a script change, or a test
- Triage
- Severity and the owner are confirmed
- Validated
- The issue is reproduced on the live system
- Fix proposed
- MapperPlus has fixed the code and opened it for review
- Deployed
- Your team released the change
Fixing a finding
Three actions sit on every open finding in the dashboard.
- Fix code fixes the code at the file and the line that cause the issue.
- Push MR opens that fix as a merge request in GitHub, GitLab, or Bitbucket for review.
- Resolve closes the finding once the change is released.
The change goes through the review your engineers already run. Nothing is merged without them.
Alerting
Findings can open a Jira ticket or a Linear issue in the project that owns the asset. Critical findings can page the on-call team through PagerDuty. Severity and the asset are copied onto the ticket, so nobody retypes them.
Bug bounty intake
With HackerOne or Bugcrowd connected, researcher reports enter the pipeline at triage. They are tied to the asset, reproduced on the live system, and fixed in your code for you, like your own findings.
Help
Questions about a workspace or an integration? Write to [email protected].
See it on your own hosts.
Enter your domain. We map what is exposed and walk you through it in a live demo.
ISO 27001 certifiedNothing to installYour team merges every fix