Why Firecracker microVMs instead of Docker?

Each scan runs in a dedicated Firecracker microVM — the same isolation technology AWS Lambda uses. Unlike Docker containers, microVMs provide hardware-level isolation, preventing any cross-scan data leakage. Boot time is ~125ms, so there's no performance penalty.

Why a queue-based architecture?

Scans are CPU and network intensive. A Redis-backed queue (BullMQ) ensures fair scheduling, automatic retries on failure, and the ability to scale scan workers horizontally without touching the API layer. It also enables priority lanes for paid tiers.

Why Claude API for report generation?

Raw vulnerability data from tools like Nuclei and OWASP ZAP is technical noise for SMB decision-makers. Claude API reasons about findings in context — correlating vulnerabilities, mapping to DPDP sections, and generating plain-language remediation that a non-technical founder can act on.

How is scan data retained and secured?

Scan artifacts are encrypted at rest (AES-256) and purged after 90 days by default. Reports are stored in the customer's account with end-to-end encryption. We never share scan data with third parties. SOC 2 Type II certification is on our 2026 roadmap.

Real Reports — Redacted

See what you get

Browse redacted reports from real engagements. Every Bachao.AI scan produces actionable, developer-friendly reports like these.

Book Free Scan View Pricing

All company names, domains, IPs, and identifying information have been masked. These reports represent the format and depth of our actual deliverables.