30+ инструментов в 6 категориях — от сканирования уязвимостей до AI-агентов. Каждая функция с реальными примерами. Всё бесплатно, кроме AI-функций на токенах OpenAI.
30+
Функции
27
Модули сканирования
6
Категории
$0
Чтобы начать
Обзор · Overview
Dashboard & Documentation
Your command center and reference manual
Панель (Dashboard)
Overview
Unified command center — all your scans, monitors, alerts and intelligence reports in one scrollable feed. Real-time WebSocket updates.
Active scans3 running
Monitors12 · all OK
Alerts today2 medium
Risk scoreA · 94/100
Widgets: active scans, recent findings, risk score
Live feed of check completions
Quick actions: new scan, add monitor, export report
Paste any URL and run 27 security checks in parallel: SQLi, XSS, open ports, SSL/TLS, headers, CORS, CSRF, CVEs and more. Full results in under 60 seconds.
Know your attack surface better than your attackers do
Армия AI-агентов
Intelligence
27 specialized security agents (XSS, SQLi, recon, auth, network, exploit-chain, review) that you can dispatch against any target. Paid — uses OpenAI tokens.
Static analysis (SAST) for your own code. Upload a ZIP or paste a public GitHub URL — Semgrep and Bandit find SQLi, XSS, IDOR, hardcoded secrets, race conditions, deserialization bugs, weak crypto across 30+ languages. AST-only — no code execution, files deleted after scan.
EnginesSemgrep + Bandit
Rules5000+
Languages30+
PrivacyFiles auto-deleted
Upload ZIP (≤100 MB) OR paste github.com / gitlab.com / bitbucket.org URL
Detects XSS the way an attacker would — parses your response with multiple HTML/JS parsers, infers the exact injection context, and crafts payloads guaranteed to break out of THAT context. Plus WAF detection & evasion, DOM XSS, Blind XSS and hidden-parameter discovery. Each finding ships with a context-specific fix.
Five distinct AI hackers — a white-hat, a script kiddie, an APT actor, an insider, and a botnet — take turns running REAL security checks against your authorised target and narrate every step in character. Same 27-module engine as a normal scan, just narrated as a live chat between attackers. Great for showing security risk to non-technical stakeholders.
Install the Browser GitHub App on your repos. Every pull request gets an automatic security review — Semgrep + Bandit run on the changed files only, and findings are posted as inline review comments on the exact lines. CWE-classified, severity-tagged, with a one-line recommendation per issue. Closed PRs stay clean.
Triggerpull_request.opened / synchronize
EnginesSemgrep + Bandit on diff
OutputInline GitHub review comments
PermissionsPull requests R/W · Contents R
Webhook signature verified with HMAC-SHA256 — no spoofing possible
Only changed source files (.py/.js/.ts/.go/.rb/.java/.php/+) are analysed — fast, focused
Top 48 findings inline + summary comment for the rest. Every finding links back to /docs#code-analyzer
One-shot security and load audit of your Linux server. Run our read-only one-liner over SSH, we collect top processes, network connections, cron jobs, log tails, and run Lynis (200+ hardening checks) plus cryptominer signature matching, DDoS-rate IP detection, and suspicious cron patterns. Single-use 1-hour token. Free. Never reads /etc/shadow or SSH keys.
Map your phishing exposure before attackers do. We mine 40+ public sources (Bing, DuckDuckGo, crt.sh, dnsdumpster, OTX, github-code, urlscan, certspotter, …) for employee email addresses, subdomains and hostnames tied to your domain. Findings come with severity, CWE-200 classification and remediation steps. Free. Passive — your servers see ZERO traffic from us.
A curated public showcase of vulnerabilities the platform has surfaced. Target names are blurred (responsible disclosure), but severity, CWE and CVE references stay so you can see the real risk caught.
Detects misconfigured access control. When an endpoint returns 403/401, we try 40 known bypass tricks — path tampering (/admin/..;/), header injection (X-Forwarded-For: 127.0.0.1, X-Original-URL), URL encoding, method swapping. Reports the ones that flip to 200. Detection-only: we never read bypassed response bodies.
Browserfisher detects leaked AWS/GCP/OpenAI/Stripe/Slack credentials in your public JS bundles, source-maps and HAR captures. Live validators ping the issuing API to confirm the key is actually active — eliminating ~90% of false positives.
Generate schema.org JSON-LD for 10 schema types in seconds. Helps Google show your site with star ratings, FAQ accordions, breadcrumbs and sitelinks searchbox — CTR can grow 20-30%.
6 new checks added from python-seo-analyzer: OG tags completeness, heading hierarchy, anchor quality (detect 'click here'), keywords meta spam check, content density (top-5 keywords), title length thresholds.
Full Google E-E-A-T evaluation framework adapted for AI-era SEO. 8 categories × 10 items: Contextual Clarity, Organization, Referenceability, Exclusivity, Experience, Expertise, Authority, Trust. 33 checks are automatable, the rest need human/AI judgment.
Browser