Pentest your web app with Claude

Point it at any web app. The crawler maps every page, form, and endpoint. Claude examines each one like a senior pentester and delivers findings with reproduction steps and remediation advice.

Cancel anytime, no long-term commitment

scan - live output

Scan started for https://example.com

Using model: claude-sonnet-5

Crawling target (depth=3, rate=2 req/s)

Crawl complete: 24 pages discovered

Analysing page 1/24: /login

Found 2 vulnerabilities on /login

· Missing CSRF token on login form [high]

· Password field with autocomplete enabled [medium]

Analysing page 2/24: /api/users

Found 1 vulnerability on /api/users

· IDOR: numeric user IDs in path, no authz check [critical]

Analysing page 3/24: /admin

Active probing found 1 confirmed vulnerability

· XSS: payload reflected in search results [high]

Analysing page 4/24

How it works

01

Enter a URL

Paste any URL: public site, staging environment, or internal app. Configure depth, rate limits, and authentication if needed.

02

Crawl & analyse

The crawler maps every page, form, and endpoint. Claude examines each one for vulnerabilities, considering full page context — headers, cookies, HTML, API responses.

03

Get actionable findings

Each finding includes a severity score, exact reproduction steps, and remediation guidance.

What makes it different

Signature-based scanners miss logic flaws, auth bypasses, and novel attack patterns. AI reasoning finds what rules can't.

Reasons over context, not patterns

Claude reads HTML structure, HTTP headers, cookies, forms, and API responses together — finding logic flaws and auth bypasses that signature-based scanners miss.

Crawls the whole site

Playwright-powered crawler discovers every page, form, endpoint, and SPA route. Up to 50 pages per scan with configurable depth.

Confirms with active probing

Optional fuzzing injects XSS, SQLi, path traversal, and open redirect payloads to confirm exploitability — not just flag suspicion.

Scans behind logins

Provide credentials once and the crawler handles session management to test your authenticated attack surface, including admin panels and protected APIs.

Streams results live

Every page analysed, every finding surfaced, and cost tracked — streamed to your dashboard as the scan runs.

Exports to PDF

Reports include severity ratings, reproduction steps, and concrete remediation advice for every finding.

What it looks for

16 vulnerability categories across the OWASP Top 10 and beyond.

XSSCross-site scripting
SQLiSQL injection
IDORBroken object-level auth
CSRFCross-site request forgery
SSRFServer-side request forgery
Broken authAuth & session flaws
Open redirectUnvalidated redirects
JWT issuesalg:none, weak secrets
CORSMisconfigured origins
Info disclosureKeys & secrets in HTML
Security headersMissing CSP, HSTS, etc.
Insecure cookiesMissing HttpOnly/Secure
Mass assignmentOver-posted fields
Path traversalDirectory escape
Exposed admin/admin, /actuator
Verbose errorsStack traces & debug info

Findings you can act on

Every vulnerability includes evidence, reproduction steps, and a concrete fix.

CriticalIDOR: Unauthenticated Access to User Records
IDOR

Description

The /api/users/[id] endpoint returns full user records including email, address, and payment info without verifying the requesting user owns the resource. Sequential integer IDs make mass enumeration trivial.

Reproduction steps

  1. Authenticate as any user
  2. Note your user ID from session
  3. Request /api/users/1, /api/users/2, …
  4. Observe full PII returned for all IDs

Remediation

Enforce ownership check server-side: compare the requested resource's owner ID against the authenticated session user before returning data. Use opaque UUIDs instead of sequential integers.

Confidence
0.92
https://example.com/api/users/[id]

Scans included, or bring your own key

Every plan includes scan credits you can spend without an API key, and every plan lets you connect your own Anthropic key and scan without limits. You choose per scan.

Get startedCancel anytime, no long-term commitment

Basic

$9.00/mo

3 scans a month included

  • 3 scan credits every month
  • Unlimited scans on your own Anthropic key (Haiku 4.5, Sonnet 5 and Opus 5)
  • Authenticated scanning
  • Scheduled scans
  • PDF reports with remediation guidance
  • Extra credits from $3.00 in bulk, never expire
Get started
Cancel anytime.
Most popular

Pro

$15.00/mo

5 scans a month included

  • 5 scan credits every month
  • Unlimited scans on your own Anthropic key (Haiku 4.5, Sonnet 5 and Opus 5)
  • Authenticated scanning
  • Scheduled scans
  • PDF reports with remediation guidance
  • Extra credits from $3.00 in bulk, never expire
Get started
Cancel anytime.
Limited offer

Lifetime

$75.60

one-time · access never expires

  • 10 scan credits, one-time
  • No monthly fees, ever
  • Unlimited scans on your own Anthropic key (Haiku 4.5, Sonnet 5 and Opus 5)
  • Authenticated scanning
  • Scheduled scans
  • PDF reports with remediation guidance
  • Extra credits from $3.00 in bulk, never expire
Get lifetime access
3-day money-back guarantee

What is a scan credit?

Credits pay for scans run on our AI — no API key, no per-token billing. A scan costs less than a credit on Haiku, one credit on Sonnet, or more on Opus: you pick the model per scan. If a scan fails through a fault of ours, the credit goes back.

Or bring your own key

Connect your Anthropic API key and scan as much as you like without touching your credits. You pay Anthropic directly at their rates. We add no markup.

Need more credits?

Top up any time from $3.00 a credit in bulk. Purchased credits never expire and survive your monthly reset. Monthly credits themselves do not roll over.

Frequently asked questions

What web vulnerabilities can AI Vulnerability Scanner detect?

AI Vulnerability Scanner detects 16+ vulnerability categories including XSS (cross-site scripting), SQL injection, IDOR (broken object-level authorisation), CSRF, SSRF, broken authentication, JWT issues, CORS misconfigurations, missing security headers, insecure cookies, path traversal, exposed admin endpoints, mass assignment, verbose errors, open redirects, and information disclosure.

How does AI-powered vulnerability scanning differ from traditional scanners like OWASP ZAP or Burp Suite?

Traditional vulnerability scanners rely on signature databases and pattern matching, which miss logic flaws, authorisation bypasses, and novel attack patterns. AI Vulnerability Scanner uses Claude AI to reason over the full context of each page - HTML structure, HTTP headers, cookies, forms, and API responses - identifying security issues that rule-based tools cannot detect.

How long does a web vulnerability scan take?

Most scans complete in 2–10 minutes depending on site size and selected model. A Haiku-powered scan of a 10-page site typically takes 2–3 minutes. A deep Sonnet analysis of a 50-page application may take up to 10 minutes. All scans stream live results to your dashboard as findings are discovered.

Can AI Vulnerability Scanner test authenticated areas behind a login?

Yes. AI Vulnerability Scanner supports authenticated scanning. Provide your credentials once and the Playwright-based crawler handles session management automatically, scanning your entire authenticated attack surface - including user dashboards, admin panels, and protected API endpoints.

Is it safe to run a vulnerability scan on a live production website?

AI Vulnerability Scanner is designed for authorised security testing with configurable rate limits (default 2 requests per second) to minimise impact on production systems. Active probing can be disabled for a passive read-only analysis. Always ensure you have explicit written permission from the site owner before scanning any target.

What is a scan credit?

A scan credit runs a scan on one URL using our AI, so you do not need an API key of your own. What a scan costs depends on the model you choose: less than a credit on Haiku, one credit on Sonnet, more on Opus. Basic includes 3 credits a month and Pro includes 5. Monthly credits reset each billing period and do not roll over. Extra credits can be bought in packs from $3 a credit in bulk, never expire, and are kept when your monthly credits reset. If a scan fails through a fault of ours, the credit is refunded automatically.

Can I use my own Anthropic API key instead of credits?

Yes, on every plan. Connect your own Anthropic API key and scan as much as you like without spending credits. Your scan costs are billed directly by Anthropic to your account at their published rates, with no markup from us. You choose per scan whether to spend a credit or use your own key.

Try it on your own app

Paste a URL, pick a model, and you'll have a full vulnerability report in under 10 minutes.

Get started

Cancel anytime, no long-term commitment