Point it at a URL. Get a real security report back.
No agent to install, no config to write. Paste a link, and a few seconds later you have a structured report: every finding rated by severity, backed by the actual response that triggered it, and paired with a concrete fix.
VulnRadar looks at a site the way an attacker would, from the outside, and reports what it finds across eighteen categories:
security headers and their misconfigurations, TLS and certificate health, cookie flags, DNS and email records (SPF, DKIM, DMARC), exposed secrets and API keys, server and framework fingerprinting, information disclosure, client-side risks, supply-chain exposure, and the kinds of mistakes that show up in AI-generated code.
Every check is deterministic. The same URL gives you the same findings with the same stable IDs, so you can diff two scans over time or fail a CI build the moment something new appears. Nothing is a guess, and nothing is padding.
New accounts get a lot without paying anything:
- Your whole attack surface in one place. Subdomain discovery, DNS and open ports, TLS grade, and a software inventory with known-CVE correlation.
- Reports that fit your workflow. Pull any finished scan as SARIF for code scanning, a PDF to hand off, Markdown for a pull request, raw JSON, or a compliance crosswalk (PCI DSS, SOC 2, ISO 27001, HIPAA, GDPR).
- Teams, not just a login. Role-based team access, scheduled scans, two-factor auth with backup codes, API keys with scopes, and webhooks.
- AI where it earns its place. An assistant for triaging and fixing findings, plus optional AI review of a GitHub repository. Bring your own key if you would rather the requests go straight to your provider.
- Meet it where you work. A REST API with an in-browser playground and ready-to-run code samples, a command-line tool for CI, and a browser extension for Chrome and Firefox.
The fastest way to understand it is to run it:
- Open vulnradar.dev and scan a site you own.
- Want to look first without an account? The live demo scans on the spot.
- Ready to automate it? The docs cover the API, the CLI, scheduled scans, and everything else.
VulnRadar is GPL-3.0 and built to be self-hosted. Your instance does everything the hosted one does.
git clone https://github.com/VulnRadar/vulnradar.dev.git
cd vulnradar.dev
cp .env.example .env # set DATABASE_URL and API_KEY_ENCRYPTION_KEY
docker compose up -dThe self-hosting guide walks through the rest.
| Repository | What it holds |
|---|---|
| vulnradar.dev | The whole thing: the Next.js app, the detection engine, the REST API, the CLI, and the browser extension. |
Built for developers and security teams who would rather see the problem than read a brochure about it.
Questions, or found something in VulnRadar itself? support@vulnradar.dev
Only scan sites you own or have permission to test.
