Most websites treat security as a one-time event: a scan before launch, a checkbox in a questionnaire, a line in the footer that says "we take security seriously." Then nothing — until something breaks. The problem is that security drifts. A certificate expires, a plugin update lands, a header quietly goes missing, a backup file ends up in the web root. TCSR (Talivio Cyber Security Report) started from a different premise: a security posture is only useful if it is verifiable, current, and something you can act on. Every part of the product follows from that.
TCSR is an on-demand cybersecurity assessment platform, built on Laravel. You prove you own a domain, run a tiered scan with our own in-house engine, and receive a clear, AI-authored report — independently verifiable, mapped to KVKK, GDPR and ISO 27001. Optional agents you install yourself surface what the outside can't see, and a self-updating badge lets you show the result in your footer.
Ownership First, Always
The fastest way to build an irresponsible security tool is to let anyone scan anything. TCSR refuses to. Before a single active check runs, you must prove control of the domain through one of four methods — a DNS TXT record, an HTML file, a meta tag, or a WHOIS/RDAP email code. Passive reconnaissance aside, every active and deep module runs exclusively against verified-owned assets. This keeps the product on the right side of the law and makes "deep" scanning something we can offer without hesitation, because the person triggering it has demonstrably earned the right to.
One In-House Engine, Three Depths
TCSR does not resell someone else's scanner. The engine is ours, and it is organised into 15 modules across three depths. Insight is passive OSINT — DNS, email security (SPF/DMARC), WHOIS, TLS certificate, HTTP security headers, technology fingerprinting, and subdomain discovery from certificate-transparency logs. Assess adds light-active checks that require verified ownership: exposed files (.git/.env/backups), directory listing, security.txt, TLS configuration, and cookie flags. Audit goes deeper still — port scanning, vulnerability probes, and known-CVE matching against the public NVD feed. Each finding carries a severity, and the whole scan is distilled into a single letter grade (A–F).
Reports Anyone Can Authenticate
A security report is only worth as much as its credibility. TCSR's reports are written by AI from the structured findings — an executive summary a non-technical decision-maker can read, prioritised findings, and a remediation roadmap — and rendered to a clean PDF. Crucially, every report carries a unique reference and a SHA-256 fingerprint. The recipient pastes the reference at our public verification page and uploads the PDF; the hash is checked entirely in their browser. A tampered or forged copy fails the check. The report is a document you can hand to a board, an auditor, or a customer — and they can prove it is genuine without trusting your word for it.
Compliance, Mapped
Findings don't exist in a vacuum. TCSR maps each one to the obligations it relates to under KVKK (Turkey), GDPR, and ISO/IEC 27001, so a missing security header or an exposed file is framed not just as a technical issue but as a compliance-relevant one. For Turkish organisations in particular, that translation between "the scan found X" and "this touches KVKK m.12 / GDPR Art. 32" is where a report stops being noise and starts being something legal and management can act on.
See What the Outside Can't
External scanning has a hard ceiling: it only sees what faces the internet. Server configuration, PHP settings, outdated packages, world-writable files, plugin versions — these are invisible from outside. So TCSR offers optional collector agents you install on infrastructure you own: a server bash script, a PHP drop-in, a WordPress plugin, and a client-side JS snippet. Each is generated with a one-time ingest token baked in, gathers internal posture, and sends only findings back over HTTPS. Those findings flow into the same report pipeline — turning an external snapshot into a genuinely deep assessment. Guardrails keep it honest: agents only run against verified domains, submissions are rate-limited and de-duplicated, and the JS snippet reports once per session rather than on every page view.
Always-On: Monitoring, Auto-Reports, and a Trust Badge
Because security drifts, a single scan ages badly. Turn on continuous monitoring and TCSR re-assesses daily, alerts you to exactly what changed between two scans, and auto-generates a fresh report whenever it detects a regression — so your latest PDF is always current. The visible payoff is a trust badge for your footer: a grade-coloured SVG seal that updates automatically and links to a public status page showing your current grade and last-assessed date, without disclosing detailed findings. It is a credible, independently-assessed signal your visitors can verify for themselves — the opposite of a static "we care about security" line.
Where AI Fits — and Where It Doesn't
TCSR uses Google Gemini at exactly two points: writing the report narrative and authoring the weekly security-news blog. Both follow the same rule the rest of our products do — graceful degradation is mandatory. The AI never gates the pipeline: the scan engine, the grading, the SHA-256 fingerprinting, and the verification registry are all deterministic. If the AI key is absent or the call fails, a local composer writes the report from the same findings, and the platform runs end to end with no API key at all. AI makes the report read better; it is never a single point of failure, and it never invents a finding the engine didn't produce.
Why This Matters
The hard part of a security-report product is not running the checks — those are well understood. The hard part is trust: making the scan something you are allowed to run, the report something a recipient can verify, the findings something management can act on, and the whole posture something that stays current instead of rotting after launch. TCSR's answer is structural — ownership-gated scanning, an in-house multi-tier engine, tamper-evident reports, compliance mapping, internal agents for depth, and always-on monitoring with a public badge. It tells you where your website stands, proves it, and keeps proving it.
