Authorized external checks
ScanLead
Paste a URL you own. Specialist agents run one-shot exposure checks and return a company-ready security brief — no account required.
What we check
Detect exposure. Do not exploit. Each pack is a short, auditable probe — not a long-running attack job.
Recon & fingerprint
Headers, tech tags, and surface map before deeper probes.
Leaks & config
.env, git metadata, backups, docs, and tech-specific paths.
Auth surfaces
Public user enum and XML-RPC-style endpoints when the stack matches.
CORS & APIs
Origin reflection and publicly reachable API documentation.
Upload & staging
Unauth upload gates and staging hosts linked from production.
Ports & mail
One-shot port presence and mail-related host resolution.
Built for trust
01
Ownership attestation
Every scan requires an explicit checkbox that you own or are authorized to test the target.
02
One-shot probes
No credential stuffing, no multi-minute sprays. Findings come from limited HTTP, DNS, and port checks.
03
Company-ready brief
Severity, evidence links, fixes, and a retest checklist you can share with your team.