A scan is not a single request. When you start one, Wolfix fans out across every signal it can reach — your codebase, your live URL, your DNS records, and your provider configuration — and runs six independent checks at the same time. Each check feeds findings into a final synthesis step that removes duplicates, assigns severity, and groups everything by department. The whole run usually finishes in 30–90 seconds.
What each step looks at
The six steps are independent, so a slow or unreachable source never blocks the others. A step that can't gather data degrades to a partial result rather than failing the whole scan.
Code scan
Detects your stack, framework, exposed API routes, the data types you collect, and the third-party services you depend on. This is what makes generated documents specific to your app.
Static URL scan
Fetches your live URL and parses the HTML for legal pages, Open Graph tags, robots.txt, sitemap, and footer links — no browser required.
Dynamic URL scan
Loads your page in a real browser to catch what only appears at runtime: cookie-consent banners, JavaScript-injected scripts, and analytics tags.
DNS checks
Resolves your domain's SPF, DKIM, DMARC, and MX records to confirm your email is authenticated and deliverable.
Provider checks
Inspects how your hosting, email, and payment providers are configured — account type, sending domain, and webhook readiness.
Regulatory mapping
Maps the data types and audiences detected above to the requirements that apply in your jurisdictions, so the report knows which rules to hold you to.
Scans are read-only
Wolfix never changes your code, your DNS, or your provider settings during a scan. It only reads what is publicly reachable or what you have explicitly connected. Nothing is modified until you choose a fix and confirm it.
How findings get their severity
Once the six steps finish, the synthesis step turns raw signals into ranked findings. Severity reflects business impact — what happens if you do nothing — not how hard the fix is.
Severity scale
A missing privacy policy and a broken payment configuration are both Blockers even though one takes minutes to fix and the other can take days. Severity is about consequence, not effort, so a quick fix can still be the most important thing on your report.
Why connection method matters
The depth of a scan depends on what you connect. Each method unlocks a different set of the six steps.
| Connection method | What it unlocks | | --- | --- | | Live URL only | Static and dynamic URL scans, DNS checks, provider checks, regulatory mapping. The code scan runs on what is observable from the browser. | | GitHub repository | Adds the full code scan — stack, routes, data types, and dependencies read directly from source. The most specific generated documents come from this. | | Lovable preview | Treated as a live URL, with platform-aware hints so Wolfix knows where to look for Lovable-specific configuration. |
Connecting both a URL and a repository gives the richest report: Wolfix can cross-check what your code claims to do against what your live site actually does.
Re-scan after every fix
Reports are point-in-time snapshots. After you generate a document or apply a code fix, run a new scan to confirm the gap is closed. Each scan is stored separately so you can compare before and after.
What you get at the end
The synthesis step hands you a single report: stat tiles at the top, a department summary strip, a severity-ranked findings list, and a fix panel on each finding. From there you can generate assets, copy code-fix prompts, or connect with vetted referral partners — all without leaving Wolfix.