Skip to main content
This guide walks you through running your first domain scan in Jsmon and understanding the results.
1

Open a Workspace

From the Workspaces page, click Open on the workspace you want to use. If you haven’t created one yet, click + to create a new workspace first.
2

Navigate to Scans

You’ll be taken to the Scans page by default. At the top, you’ll see a domain input field with the placeholder “Enter a domain to scan”.
3

Enter a Domain

Type the target domain you want to scan (e.g., example.com) into the input field. Make sure Domain Scan is selected as the scan type.
4

Configure Options (Optional)

Click Options (Depth, Headers, Extensions) to customize your scan:
  • Extensions — Choose which file types to scan (.html, .php, .js, .json, etc.)
  • URL Extraction Depth — Set the crawl depth from 1 to 4 levels
  • WAF Bypass — Enable to scan behind Web Application Firewalls (paid plans only)
  • Keywords — Add keywords to filter results
  • Custom Headers — Add authentication or custom headers to your requests
5

Start the Scan

Click the Start Scan button (the blue send icon). Your scan will be queued and begin processing. You can monitor its status in the scan list below.
6

Review Results

Once the scan completes (status shows as “Completed”), click on the scan row to open the detail panel. You’ll see:
  • Overview — Summary cards showing API Endpoints, URLs Scanned, Issues, and PII Data found, plus a list of discovered endpoints
  • Secrets — Any leaked API keys, tokens, or credentials found
  • Reconnaissance — All discovered assets categorized by type
Your Scan Credits balance is displayed at the top of the Scans page. Each scan consumes credits based on the number of URLs analyzed. The free Starter plan includes 1,500 lifetime credits.

​
What Happens During a Scan?

When you initiate a domain scan, Jsmon performs the following steps:
  1. DNS Resolution — Resolves the target domain and identifies associated IP addresses
  2. URL Discovery — Crawls the domain to discover all accessible URLs and JavaScript files
  3. Asset Extraction — Parses JavaScript files and web pages to extract API endpoints, parameters, domains, and other assets
  4. Secret Detection — Scans for leaked API keys, tokens, credentials, and other sensitive data
  5. Vulnerability Analysis — Identifies common vulnerabilities and security misconfigurations
  6. Categorization — Organizes all findings into the Reconnaissance categories for easy browsing

​
Scan Statuses

Your scan will show one of these statuses: If a scan fails, you can view the failure reason in the scan detail panel and click Report it to Us to notify the Jsmon team.