Free to scan. Pay for depth.
Every scan is graded against CVSS 3.1, CWE, and OWASP Top 10 — no black-box scores. Pro at $10/mo adds deep crawls and monitoring; Advanced at $25/mo unlocks authorized active testing on domains you verify.
Free
Quick checks and solo use
Pro
Freelancers, indie hackers & site owners
Advanced
Agencies & security-conscious teams
Enterprise
Platforms and marketplaces
| Feature | Free | Pro | Advanced | Enterprise |
|---|---|---|---|---|
| Scanning | ||||
| Scans per day | 5 | 50 | Unlimited | Unlimited |
| Instant scan | ||||
| Deep multi-page crawl | 1 trial | |||
| All scan types (cyber, quantum, GEO, AI, blockchain) | ||||
| Security findings | ||||
| CVSS 3.1 · CWE · OWASP-graded findings | ||||
| CVE correlation (OSV live feed + curated KB) | ||||
| Deep passive engines (cipher enum, exposure, takeover) | ||||
| Active testing on verified domains (XSS · SQLi · SSRF) | ||||
| Full remediation plans with exact fix commands | ||||
| Reporting & workflow | ||||
| Saved report history | 7 days | Unlimited | Unlimited | Unlimited |
| PDF export | ||||
| Shareable report links | ||||
| Webhooks (score-drop alerts) | ||||
| Priority processing | ||||
| Platform | ||||
| Bulk URL API + evidence-level JSON | ||||
| SSO / SAML | ||||
| SLA & dedicated rate limits | ||||
| Change monitoring + alerts | Weekly | Daily | Daily | Real-time |
| Support | Community | Priority email | Priority email + onboarding | |
5–10× cheaper
Detectify and Intruder start at $50–110/mo. Pro is $10 — with active testing Advanced doesn't offer at any price.
Evidence, not vibes
Every finding ships raw evidence, CVSS vector, CWE and OWASP mapping. Verify us against any competitor.
Cancel anytime
No annual lock-in, no sales calls. Upgrade, downgrade, or cancel from your dashboard.
Common questions
01Is there really a free plan?
Yes. Anonymous visitors get 3 instant scans/day; a free account raises that to 5/day plus one deep-scan trial. Free scans are fully standards-graded — every finding carries a CVSS score, CWE id, and OWASP category.
02What is active testing, and why does it need a verified domain?
Active testing sends real (but non-destructive) payloads — reflected XSS, SQL injection, path traversal, open redirect, and out-of-band SSRF — to find exploitable flaws. Sending payloads to a site you don't own is unauthorized testing, so we only run it against domains you have proven you control via a DNS TXT record or hosted file. It's available on the Advanced plan ($25/mo).
03What's the difference between instant and deep scans?
Instant scans the homepage plus DNS/TLS/headers for a fast graded snapshot. Deep crawls a bounded multi-page sample and runs the heavier passive attack-surface engines (cipher enumeration, sensitive-file exposure, subdomain-takeover detection). Pro includes 50 scans/day of either type — and every free account gets one deep scan to try.
04How current is the CVE data?
Detected components with a version are matched against a curated high-signal knowledge base and, in parallel, the live OSV.dev feed — so newly published advisories surface without waiting for an app update.
05Are the findings a black-box score?
No. Every finding shows the raw evidence, the CVSS 3.1 vector it was scored from, the CWE and OWASP references, and remediation guidance — so you (or an auditor) can verify it independently. Advanced adds full per-finding remediation plans with priority ordering and exact fix commands.
06Can I cancel anytime?
Yes. Cancel from your dashboard; your plan stays active until the end of the current billing period.