Free scan
Choose a free scan
Two free, no-signup scans. Pick the one that fits what you want to check — results are in-memory and nothing is stored.
Website security scanner
Paste a URL and run 17 passive checks against any website you own, scored 0 to 100.
- TLS, headers & cookies — certificate chain and expiry, HSTS, CSP, X-Frame-Options, Secure/HttpOnly/SameSite flags.
- Forms, server & exposure files — insecure submissions, version disclosure, robots.txt, exposed logs, auth/admin pages, security.txt.
- DNS & email security — SPF, DMARC, CAA and DNSSEC so your domain resists spoofing.
- CORS, WAF & OSINT — permissive CORS, firewall detection, public contacts, archive snapshots and llms.txt.
AWS IAM policy scanner
Paste or upload an IAM policy JSON and get an instant least-privilege assessment, scored 0 to 100.
- IAM, STS & Organizations — identity tampering, AssumeRole abuse, long-lived tokens and risky Organizations or account changes.
- S3, KMS & Secrets — public bucket edits, KMS key policy rewrites and reading plaintext secrets.
- Lambda, EC2 & data services — PassRole escalation paths plus destructive actions on RDS, DynamoDB and backups.
- Guardrails & trust policies — wildcard permissions, public trust principals, missing conditions and broad managed policies.
Deeper assessment
Want more than a free scan?
Broader cloud posture, container, IaC and multi-tool finding workflows are planned. The live toolbox shows exactly which checks are available today.