Scanner Coverage
The Vulnerability Scanner is built for broad first-pass security testing.
The scanner performs 40 plus automated checks so developers, security teams, and owners can quickly understand where manual review should go next.
Injection attacks
Checks include SQL injection, NoSQL injection, OS command injection, and LDAP injection pathways.
Cross-site scripting
Covers reflected, stored, DOM-based, and cookieless XSS paths that can compromise user sessions or trust.
Server-side risks
Reviews SSRF, LFI or RFI, open redirect, and code injection patterns that expose backend behavior.
Authentication and session
Looks for JWT weaknesses, session fixation, weak password handling, and cleartext credential exposure.
Access control and headers
Identifies IDOR issues, missing security headers, and policy gaps that weaken application boundaries.
Information disclosure
Searches for directory listing, sensitive files, debug output, comments, archives, certificates, and other leaks.
API security
Scans for GraphQL endpoint discovery, OpenAPI fuzzing opportunities, and insecure deserialization behavior.
Configuration flaws
Flags CORS misconfiguration, TRACE or TRACK exposure, missing security.txt, and weak cookie attributes.