Step 1 - Create an account
Go to /register and fill in your details. After registration you'll receive a verification email. Click the link in the email to activate your account.
Step 2 - Log in and open the scanner
After logging in you'll land on the scanner dashboard. If you see the landing page, click Sign In in the top navigation.
Step 3 - Enter a target URL
In the Target URL field, enter the full URL of the site you want to scan, including the scheme:
https://example.com
Step 4 - Choose a scan type
Select one of four scan types from the dropdown:
- Vulnerability - OWASP Top 10 checks only (fastest)
- Performance - DNS, TTFB, HTTP/2, compression, caching
- Full - both vulnerability and performance (recommended)
- API - REST API-specific checks: BOLA, mass assignment, rate limiting, GraphQL introspection, excessive data exposure
Step 5 - Start the scan
Click Start Scan. The progress panel will appear immediately with live updates as each check completes. Typical scan duration is 30-90 seconds depending on the site and scan type.
Step 6 - Review results
When the scan completes, results are grouped by severity:
| Severity | Meaning |
|---|---|
| CRITICAL | Immediate risk. Direct exploitation likely. |
| HIGH | Significant risk. Should be fixed promptly. |
| MEDIUM | Moderate risk. Fix when possible. |
| LOW | Minor risk or best-practice violation. |
| INFO | Informational. No immediate risk. |
Step 7 - Download a report
Click Download PDF to get a professional report with all findings, evidence, OWASP mapping, and remediation steps. You can also export as JSON, CSV, or SARIF from the same panel.