// tool reference · Vulnerability & Assessment
AI Vulnerability Scanner Free + Pro
Passively scan any site you own for misconfigurations, with AI countermeasures.
Open AI Vulnerability Scanner →
What it does
Scans a web target you control for missing headers, cookie flags, TLS configuration, exposed paths and version disclosure. It is deliberately conservative: bounded request count, no exploitation, and an authorisation gate you must tick.
When to use it
- Before shipping a site, as a final external check.
- After a config change, to confirm you did not regress a header.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| target | url | required | Full URL including scheme. Must be publicly resolvable. |
| authorized | checkbox | required | You confirm you own the target or have written permission. |
| use_ai | checkbox | optional | Add AI prioritisation over the deterministic findings. |
What you get back
Findings with severity and the exact configuration change to make.
Worked example
Input
https://example.com (authorized [x])
Output (abridged)
HIGH Strict-Transport-Security missing
-> Strict-Transport-Security: max-age=31536000; includeSubDomains
HIGH Session cookie without Secure or HttpOnly
-> Set-Cookie: id=...; Secure; HttpOnly; SameSite=Lax
Any XSS can read this cookie today.
MEDIUM Content-Security-Policy missing
-> default-src 'self'; object-src 'none'; frame-ancestors 'none'
LOW Server: nginx/1.18.0 discloses an exact version
-> server_tokens off;
Scanned 14 of a permitted 16 requests. No exploitation attempted.
How it works
Deterministic probing within a hard request budget. Every request is SSRF-guarded: the hostname is resolved, checked against internal/reserved ranges, and the connection is PINNED to the validated public IP, so DNS cannot be rebound between check and fetch. Redirects are never auto-followed.
Limits
Read live from the platform configuration.
| Free | — scan |
| Pro | — scans |
| Requests/scan | — |
| Timeout | —s |
| Response cap | — bytes |
| Top-ups | Vuln Scan Pack |
Limitations — what it does not do
It is a CONFIGURATION scanner, not a penetration test. It never exploits, never fuzzes, never authenticates and never crawls deeply. It will not find business-logic flaws, IDOR, or anything behind a login. A clean result means the externally-visible configuration is sound -- not that the application is secure.
Privacy
The target URL and findings are retained against your account for your scan history.
Standards
OWASP Top 10OWASP Secure HeadersCWE