Assurance between releases, not just before them
A one-time audit is a photograph. Your app is a movie: every deploy changes the surface, every dependency bump changes the risk. Monitor re-scans daily and emails you when something moves, and the CI/CD gate checks the release before it ships — the same evidence standard, continuously.
The three layers of "continuous"
Daily re-scans
Monitor ($49/domain/month) re-runs the passive and structural checks every day against your live surface, with a manifest-pinned record of every scan.
Change alerts
Something new shows up — an exposed file, a header that regressed, a component version that moved — and you get an email with the evidence, the same day.
Release gating
The CI/CD gate calls the same engine from your pipeline via the REST API, so a regression fails the build instead of shipping to customers.
Where it fits your setup
One domain runs on Monitor alone at $49/month. Pro ($199) covers 5 domains; Agency ($499) covers 25 with white-label reports. All of them ride on the same engine as the one-time audit.
Pull findings into your issue tracker through the REST API, let an agent query your surface through the MCP server, or gate deploys with the CI/CD docs' recipes. The evidence format is the same in every channel.
Monitor is a re-scan for change, not a daily deep audit — the deep hunt stays a one-time $149 credit you buy when the scorecard or a Monitor alert justifies it. That split keeps both honest and affordable.
The rhythm that works
Once
A Deep Audit ($149) establishes the verified baseline — every finding with its proof.
Daily
Monitor watches for change and emails you on every one, at $49 per domain per month.
Every release
The CI/CD gate checks what's about to ship, so the baseline degrades only if a change sneaks past it.
The full tier math lives on pricing; what the evidence looks like is in the sample verified report.
Questions about going continuous
How is Monitor different from the Deep Audit?
The Deep Audit is a deep, one-time run (~360 requests, ~60 minutes) that hunts and verifies findings. Monitor is a daily re-scan of the same surface for change: new exposure, new component versions, regressions in what was previously clean. It is breadth-over-time, not depth-on-demand — buy another audit credit when you need the deep hunt again.
Can the CI/CD gate fail my build?
Yes — that is the point. Your pipeline calls the engine via the REST API and the gate evaluates the results against your configured threshold, failing the build when a check regresses. Setup and examples are in the CI/CD docs.
What actually arrives in my inbox?
An email when something changes: what changed, where, and the evidence behind it. Nothing changes, no email — the point is signal, not a daily digest of silence.
Free scorecard first — the passive profile it builds is what Monitor re-checks every day.
Related: the Monitor page for the day-to-day mechanics, the CI/CD gate docs for pipeline wiring, and pricing for how the tiers stack across domains.