Find out what an attacker would find on your site

Comprehensive

Lite, plus active scanning and every active check this install supports. Free during early access; needs a domain you have verified.

Everything in Lite, plus deeper tests that actively try to find real weaknesses. Free while lannerva is in early access, once you prove you own the site.

• Everything in Lite
• SQL injection, XSS, command injection
• SSRF to cloud metadata services
• NoSQL injection
• Prototype pollution
• JWT attacks
• GraphQL attacks (introspection, DoS, CSRF)
• Content & directory discovery
• IDOR & broken access control
• Login brute-force check
• DOM-based XSS
• File upload bypass
• Business-logic / price tampering
• Weak or sequential session IDs
• Blind XXE
• Template-based vulnerability scanning
• Session not invalidated on logout
• Race conditions & missing idempotency
• Open redirect

• Everything in Lite
• Attempts to manipulate your database, inject malicious code, or run commands on your server
• Whether your server can be tricked into fetching sensitive internal data
• Database manipulation attacks against non-SQL databases
• A JavaScript-specific attack that can corrupt how your app behaves
• Weaknesses in how your site recognizes logged-in users
• Weaknesses in your site's API
• Hidden pages or files an attacker could find
• Whether one user can see or change another user's data
• Whether your login page blocks repeated password guessing
• Malicious code that runs inside a visitor's browser
• Whether dangerous file types can be uploaded
• Whether prices or quantities can be manipulated
• Whether login sessions are easy to guess
• A hidden attack through how your site reads XML files
• Checks against a library of known vulnerabilities
• Whether logging out actually ends your session
• Whether an action can be repeated to cheat the system, like redeeming a coupon twice
• Whether your site can be used to redirect visitors somewhere malicious

Max (coming soon)

Not available yet. Everything in Comprehensive, plus an AI scanner-and-validator swarm that actively investigates your site beyond a fixed checklist.

• Everything in Comprehensive
• AI-driven exploration of your attack surface, not limited to a fixed checklist
• Multi-step, chained-vulnerability reasoning a mechanical scanner can't do
• Findings independently re-checked by a validator pass before being reported
• Human approval required before any exploit-class action

Retest

Re-run only the check types that found something in a prior run, and diff against it.

No fixed checklist of its own: it inherits whichever Lite or Comprehensive checks that earlier run used, then shows what's resolved, new, or still open.