Scan your web app from its URL
A browser pass and seven security tools check your live site. Issues the scan can exploit are marked Proven, with the probe it sent and what came back.
Free plan, 1 scan a month
Proof for what it can exploit
When a probe confirms an issue, the finding shows the request it sent and what your site returned.
One queue for every finding
Findings land in a review queue you can filter by severity and type. Filtered-out results stay a click away.
Pages behind a login
On paid plans the scan stops at a login, asks you for what it needs, then picks up where it stopped.
The tools behind it
curl, testssl.sh, nuclei, nmap, gobuster, nslookup and whatweb run against your site, and their results are triaged into findings.
How setup works
- 1
Add your site
Create a project with the URL you want to scan.
- 2
Verify the domain
Add a DNS TXT record so we know you may test it.
- 3
Run a scan
Start it from the project. Paid plans can also run it on a schedule or from your coding agent over MCP.
Pricing
Web app scanning is on every plan, from the free Basic plan. Basic shows the first 3 findings of each scan. Compare plans
Questions
Does it replace a pentest?
No. It is not a certified penetration test or an ASV scan. Run it between pentests to catch common issues early.
What does Proven mean?
A probe confirmed the issue on your live site. Findings the scan could not confirm are never marked Proven.
Can I scan a site I do not own?
Only with permission. You verify each domain through DNS, and site owners can opt out of all scans.
Where do results go?
Into the project and the Issues list, with a PDF report you can share. Starter adds Slack and Teams alerts, and Team adds Jira, GitHub Issues and webhooks.