Modules

Security checks

Vulnara runs 15 automated security checks across your site. Each check targets a different class of vulnerability. Higher plans unlock more checks.

FreeFree plan(6 checks)

Port & service scan

Network exposure

Checks which ports and services on your server are reachable from the internet.

Finds

Databases, admin panels, or internal services accidentally exposed to the public.

Encryption check

Encryption

Verifies your HTTPS setup - certificate validity, supported cipher suites, and protocol versions.

Finds

Weak or outdated encryption that could let attackers intercept traffic.

Server misconfiguration

Configuration

Checks for known server and framework misconfigurations, exposed admin paths, and missing security headers.

Finds

Exposed .env files, open debug pages, default credentials, directory listings.

Leaked secrets in JavaScript

Sensitive data

Downloads and scans your site's JavaScript files for accidentally included API keys, tokens, and passwords.

Finds

AWS keys, Stripe keys, database URLs, internal service credentials in your frontend code.

Cross-origin request check

Configuration

Tests how your server responds to requests from other websites.

Finds

Overly permissive CORS settings that let any site make authenticated requests on your users' behalf.

Technology fingerprinting

Information exposure

Identifies the frameworks, CMS, server software, and libraries your site runs.

Finds

Outdated versions with known security issues; information that attackers use to target attacks.

StarterStarter plan(5 checks)

Database injection

Data security

Tests form fields and API inputs to see if malicious database commands can be injected.

Finds

SQL and NoSQL injection flaws that could expose or destroy your entire database.

Script injection

Data security

Submits crafted payloads into your site's inputs to check if they get executed as code in a browser.

Finds

Cross-site scripting (XSS) - attackers hijack user sessions or steal data by running scripts in your users' browsers.

Command injection

Data security

Tests inputs that might be passed to the operating system to see if server commands can be injected.

Finds

Remote code execution flaws - the most severe category of web vulnerability.

Login token security

Authentication

Checks how your site issues and validates the tokens used to keep users logged in.

Finds

Tokens signed with weak secrets or that can be forged - allowing attackers to log in as anyone.

Hidden parameter discovery

Attack surface

Probes your API endpoints for undocumented parameters that affect behaviour.

Finds

Debug flags, privilege escalation parameters, and hidden features that were never meant to be public.

PremiumPremium plan(3 checks)

Access control

Authorization

Creates two separate test accounts on your site, maps every API call as the first user, then replays each request as the second user to check what they can access.

Finds

Users who can view, edit, or delete each other's private data - orders, profiles, files, messages.

Internal network access

Server security

Tests URL inputs on your site to see if an attacker could use your server to make requests to internal systems.

Finds

Vulnerabilities that expose your internal network, cloud metadata (AWS credentials), or internal admin services.

Hidden page discovery

Attack surface

Tries thousands of common filenames and paths to discover pages and files not linked from your site.

Finds

Admin panels, backup files, old API versions, and staging endpoints accidentally left publicly accessible.

EnterpriseEnterprise plan(1 check)

Business logic review

Business logic

An AI reviews your site's workflows - checkout flows, pricing, user permissions, access rules - looking for logical flaws.

Finds

Bypassing payment flows, applying coupons unlimited times, accessing premium features without paying, privilege escalation through multi-step actions.

API reference