Quickstart Guide
Add your first domain and run your first scan in a few minutes.
1. Sign in
Go to /login and sign in with your email or via Google. On your first login you'll be prompted to create a team. Give it a name and you're in.
2. Add a domain
From the dashboard, click Domains → + Add Domain. Enter your apex domain without the protocol (e.g. example.com, not https://example.com), then confirm.
You must only scan domains you own or have explicit written authorization to test. See Rules of Engagement.
3. Run a scan
Open your domain and click Run Scan. Choose which modules to run:
- Subdomains: Discovers hostnames and DNS records
- Ports & Services: Checks for exposed network services
- Endpoints & Headers: Crawls routes and evaluates security headers
- S3 Buckets: Checks for misconfigured public cloud storage
- Vulnerabilities: Identifies CVEs across discovered assets
Scans run in the background. Progress updates in real time on the dashboard.
4. Review findings
Once complete, the results are organized into tabs:
- Subdomains: All discovered hostnames with their IP, CDN, DNS record type, and status
- Endpoints: Crawled URLs with status codes; click any row to see a full security header breakdown
- Vulnerabilities: CVEs sorted by severity (Critical → Low) with remediation steps
- S3 Buckets: Cloud storage buckets and their access permissions
- Ports / IPs: Open ports and service banners per IP address
5. Export a report
Click Export Report on any domain to generate a PDF with your full security posture: risk summary, asset inventory, and compliance mappings ready for auditors or leadership.