Platform Architecture
apPosture is an Application Security Posture Management (ASPM) platform: a single control plane that runs its own scanners (DAST, SAST, SCA, containers, IaC, secrets, Kubernetes), ingests third-party findings, deduplicates everything into one model, correlates it into attack chains, and reports on it.
This page is the high-level technical map. For the testing engine see the Scan Pipeline; for how results are stored and deduplicated see the Unified Data Model.
System architecture
Everything runs as containers behind a single edge reverse proxy that
terminates TLS and serves the app and API same-origin (/api/* is proxied
to the backend, so there is no CORS and no separate API host).
Tier responsibilities
| Tier | Component | Responsibility |
|---|---|---|
| Edge | Edge reverse proxy | TLS termination, same-origin routing, /docs + /wiki portals |
| UI | Web frontend | Dashboards, live scan streaming, report rendering |
| Core | Application backend | REST API, auth/RBAC, scan orchestration, correlation |
| State | Relational database | System of record (findings, vulnerabilities, assessments, posture) |
| State | In-memory store | Scan queue, concurrency slots, live event/finding streams |
| Engines | Browser-based DAST engine pool | Crawl + active attack traffic |
| Engines | Signature & multi-engine runners | CVE/misconfig signatures, best-of-breed cross-checks |
| AI | Local LLM runtime | False-positive triage, business impact, fix suggestions, agentic exploit loop |
The LLM runs locally and all external feeds (threat intel, OSV, KEV/EPSS, SCM) are opt-in egress. With them disabled the platform runs fully offline against its bundled rule packs and curated vulnerability database.
Request & scan flow
A scan is created over the API, queued, picked up by a worker that drives the engine pool, and streamed back to the browser in real time.
Concurrency is bounded by the number of scanner slots; extra scans wait in the queue and are promoted automatically as slots free up. See Running a scan.
Functional modules
The product surface maps onto the backend services as follows.
- Discover - what you own: Applications, Targets, Discovery, Integrations.
- Test - first-party scanners: DAST, Code Security, API Security, Kubernetes Posture.
- Unify - one model for everything: Vulnerabilities, Assessments, Import.
- Reason - context & correlation: Threat Intel, Attack Chains, Threat Models, Priorities.
- Act - drive remediation: CI/CD, Governance, Reporting.
Deployment topology
The whole stack is delivered as a containerized deployment. Stateful services use persistent volumes; the scanner pool is sized for parallel scans.
The independent watchdog probes every service externally and alerts on down/recover, so it still fires when the backend or database itself is down - see Health & Maintenance.
Next
- Scan Pipeline - the phased DAST + AI exploitation engine.
- Unified Data Model - findings, vulnerabilities, assessments.
- ASPM Coverage - how posture is rolled up.