Find out what an attacker would find on your site

Comprehensive

Lite, plus active scanning and every paid-tier check this install supports.

Everything in Lite, plus deeper tests that actively try to find real weaknesses.

• Everything in Lite
• SQL injection, XSS, command injection
• SSRF to cloud metadata services
• NoSQL injection
• Prototype pollution
• JWT attacks
• GraphQL attacks (introspection, DoS, CSRF)
• Content & directory discovery
• IDOR & broken access control
• Login brute-force check
• DOM-based XSS
• File upload bypass
• Business-logic / price tampering
• Weak or sequential session IDs
• Blind XXE
• Template-based vulnerability scanning
• Session not invalidated on logout
• Race conditions & missing idempotency
• Open redirect

• Everything in Lite
• Attempts to manipulate your database, inject malicious code, or run commands on your server
• Whether your server can be tricked into fetching sensitive internal data
• Database manipulation attacks against non-SQL databases
• A JavaScript-specific attack that can corrupt how your app behaves
• Weaknesses in how your site recognizes logged-in users
• Weaknesses in your site's API
• Hidden pages or files an attacker could find
• Whether one user can see or change another user's data
• Whether your login page blocks repeated password guessing
• Malicious code that runs inside a visitor's browser
• Whether dangerous file types can be uploaded
• Whether prices or quantities can be manipulated
• Whether login sessions are easy to guess
• A hidden attack through how your site reads XML files
• Checks against a library of known vulnerabilities
• Whether logging out actually ends your session
• Whether an action can be repeated to cheat the system, like redeeming a coupon twice
• Whether your site can be used to redirect visitors somewhere malicious

Max (coming soon)

Not available yet. Everything in Comprehensive, plus an AI scanner-and-validator swarm that actively investigates your site beyond a fixed checklist.

• Everything in Comprehensive
• AI-driven exploration of your attack surface, not limited to a fixed checklist
• Multi-step, chained-vulnerability reasoning a mechanical scanner can't do
• Findings independently re-checked by a validator pass before being reported
• Human approval required before any exploit-class action

Retest

Re-run only the check types that found something in a prior run, and diff against it.

No fixed checklist of its own: it inherits whichever Lite or Comprehensive checks that earlier run used, then shows what's resolved, new, or still open.