UNScan in progress
Surface scan · 36 scanners◇
Scanning acme-app.com
68%Checking exposed services and public files
InitializeScanAnalyzeReport
Scanner activity
✓Security headersComplete
✓DNS & emailComplete
›Exposed secretsRunning
Find security issues before launch
Scan before
you getpwned.
700+ checks in under 2 minutes. Findings are free; paid plans unlock AI fix prompts.
No credit cardRead-only scanSee findings free
Live report preview
>_acme-app.com
>_LiveReal data · hourly
3.0K+Scans run
21.2K+Findings detected
700+Security checks
36Scanners
<2 minTypical scan
NVD · CISA KEV · EPSS · OSV · OWASP Official security checker · SaaStore Featured on Let's AIThis product uses the NVD API but is not endorsed or certified by the NVD.
CVE RadarSee what is actually exploited5 active right now · KEV + EPSS→Attack surface coverage
One URL. The public attack surface.
UNPWNED coordinates multiple scanners across the exposed layers of your site, then turns the signals into one prioritized report.
Web & browser
Headers · CSP · cookies
APIs & inputs
Routes · CORS · forms · rate limits
Infrastructure
TLS · DNS · email · ports
Code & cloud
Secrets · CVEs · source maps · storage
UNPWNED36 scanners
700+ checks · full suite
One prioritized report
700+ checks · full suite
One prioritized report
Verified Deep ScanEndpoints · subdomains · form tests · redirects · cloakingSQLi / XSS with authorization
Product walkthrough
See a real scan from start to report.
Watch the full UNPWNED workflow in 81 seconds.01:21
The whole picture
See the risk. Know where to start.
A score is not enough. UNPWNED shows your overall posture, the findings that need attention first and the areas the scan covered.
Security posture
Your overall state at a glance.
C64 / 100
Finding priority
Start with the risks that matter most.
Critical1
High3
Medium5
Low2
Attack-surface map
Where you stand, layer by layer.
WebclearAPIreviewInfraclearCloudexposed
2 clear1 review1 exposed
Beyond the first scan
Scan it. Fix it. Keep watching.
UNPWNED stays in the developer workflow after the score appears. Explore the core ways it turns security evidence into action.
Turn evidence into a fix prompt.
Redacted, finding-specific instructions for the AI tool you already use.
Critical
Privileged key exposed in a public bundle
app/static/chunks/config.js
client-visible bundleFix prompt ready →Fix a critical client-side exposure in a Next.js app.
- 1Move privileged Supabase access to a server-only route
- 2Rotate the exposed credential before deploy
- 3Require auth, scope every query to the current user
- 4Confirm the key is gone from the client bundle
Paste into
+ any other AI tool
UNPWNED ECOSYSTEMOne security workflow
Connected developer workflow
Works where you build, ship and respond.
From source code to the final fix, UNPWNED connects, alerts, adapts and detects across the tools you already use.
28workflow touchpoints
Grouped by what each one actually does. None of them is a requirement.
Developer preview
Personal API key · your scan data only · built for developer clients
Israeli Privacy Readiness
Opt-in Amendment 13 readiness checks · not certification
AI fix prompts 15
Every prompt is plain text, so it works in any AI tool. These are the ones we shape the output for.
Claude: AI fix prompt destinationCursor: AI fix prompt destinationChatGPT: AI fix prompt destinationCopilot: AI fix prompt destinationLovable: AI fix prompt destinationBolt: AI fix prompt destinationWindsurf: AI fix prompt destinationReplit: AI fix prompt destinationBase44: AI fix prompt destinationCodex: AI fix prompt destinationGemini: AI fix prompt destinationVS Code: AI fix prompt destinationv0: AI fix prompt destinationElementor: Platform-specific fix prompt destinationWordPress: Fingerprint and platform-specific fix prompts
Detected in your stack 8
A sample of what the scanner fingerprints. Scanning runs on any stack, listed here or not.
Next.js: Detected technology fingerprintSupabase: Detected technology fingerprintVercel: Detected technology fingerprintFirebase: Detected technology fingerprintWordPress: Fingerprint and platform-specific fix promptsAWS: Amazon S3 public exposure detectionGoogle Cloud: Public bucket exposure detectionAzure: Public container exposure detection
Connections you authorize 3
Read-only and revocable. This is the complete list; nothing else is ever connected.
GitHub: Read-only repository connectionCloudflare: Limited DNS connectionMCP: Personal API key connection
Alert destinations 3
Slack, Discord, or any endpoint you point a webhook at.
Slack: Scan alert destinationDiscord: Scan alert destinationWebhook: Custom alert destination
Brand marks identify compatible services and supported workflows. No partnership or endorsement is implied.
Questions
Straight answers. No security theater.
What developers ask before their first scan. More in the full FAQ.
Is my data secure? What do you access?
Everything scans over the network - the same way a browser visits your site. We never access your source code, server, or database. GitHub scans use read-only tokens you can revoke anytime. All data encrypted with AES-256.
Can a scanner really protect me?
No tool catches everything - and we are upfront about that. But finding exposed .env files, leaked API keys, and missing security headers before an attacker does matters. Think of it as a pre-flight checklist, not a guarantee.
How long does it take to check my website security?
You can check this stuff manually for free, but it will take 40+ hours to cover what UNPWNED checks in under 2 minutes. Plus you would need to learn OWASP Top 10, HTTP security headers, DNS security, CSP policies, and repeat it after every deployment.
Is my app too small to be a target?
Bots do not check your company size. Automated scanners hit every domain on the internet looking for exposed .env files, open admin panels, and default credentials. If you are online, you are a target.
How much does UNPWNED cost?
Free includes 2 scans a month and shows what is wrong: score, grade, severity, and all finding titles. Paid plans show how to fix it and add unlimited re-scans, fix verification, deep scans, full details, AI fix prompts, PDF reports, monitoring, and scan history. Solo costs $9/month or $90/year for 1 domain, Studio costs $29/month or $290/year for 5 domains, and Scale costs $49/month or $490/year for 15 domains.
Free
Solo
Studio
Scale