Changelog

What's new

OnScanner has been in development since 2023 and scanning live targets since 2024. A running log of the major releases along the way, newest first. Routine fixes and smaller improvements are left out.

  1. Authenticated scanning & account security

    • Authenticated scanning, scan the application behind the login while keeping the attacker's outside-in view. Provide a session cookie, bearer token, or basic auth for a one-off scan, or save a form login or recorded sign-in per target (encrypted at rest) so repeat scans, monitors, and schedules authenticate on their own.
    • Deeper authenticated checks, the scanner confirms the login before scanning, explores the post-login application, discovers access-gated API definitions, and tests write paths and cross-account access using a second identity.
    • Two-factor authentication (2FA), protect sign-in with a 6-digit code from an authenticator app, backed by one-time recovery codes and a secure reset flow.
    • Guides & comparisons, practical write-ups on the blog and source-linked comparisons with the major commercial scanners.
    • Email security in context, sender-authentication checks are now subdomain-aware, and targets that don't handle email are marked not applicable instead of flagged.

  2. AI Findings

    • AI Findings, optional opt-in analysis on top of any scan that summarizes results, explains each issue in plain language, and recommends fixes. It correlates related issues into attack chains and a MITRE ATT&CK kill chain, and assesses readiness against SOC 2, ISO 27001, GDPR, PCI-DSS, and HIPAA. Everything is grounded against your actual scan, so it can't invent issues or understate severity.
    • Scan-completion notifications, email alerts the moment monitors and scheduled scans finish.

  3. AI agents

    • Run scans from your AI agent, kick off scans and read results directly from Claude, Cursor, and other compatible AI assistants, with discovery built in so an agent can find and use OnScanner on its own. Access is always tied to your own account and permissions.

  4. Monitoring overhaul & privacy precision

    • Monitoring overhaul, a current-posture scorecard at a glance, clearer change detection between scans, and automatic reclassification of issues as they get fixed over time.
    • Privacy-scanner precision, far fewer false positives across consent banners, session recorders, and first-party scripts, with stricter evidence-based scoring.

  5. End-of-life detection

    • End-of-life (EOL) detection, flag products and versions past end-of-life that no longer receive security support, separate from individual known vulnerabilities, so aging software gets surfaced even when it has no open CVE yet.

  6. Active exploitation probes

    • Active exploitation probes, safe, non-destructive, in-band verification of whether a known vulnerability is actually exploitable on targets you're authorized to test. This separates real, reachable risk from version numbers that merely look vulnerable.

  7. Team accounts & billing

    • Team accounts & roles, Owner, Member, and Viewer roles for shared accounts, with login history and audit context so you can see who did what.
    • Subscriptions & credits, plans, per-scan credits, one-time top-ups, and auto-refill, so scanning scales with how much you actually use.

  8. Vulnerability prioritization

    • Exploit-based prioritization, rank findings by their exploit-prediction score and flag the ones on the authoritative catalog of vulnerabilities known to be exploited in the wild, so the most urgent issues rise to the top.
    • Patch-status detection, distinguish patched, unpatched, and won't-fix issues, so you act on what's actually fixable instead of chasing noise.

  9. Sharper fingerprinting

    • Fingerprinting confidence, a confidence level for every detected technology, backed by authoritative product identifiers and extra matching signals to cut guesswork and reduce misidentification.

  10. Scheduled scans & monitoring

    • Scheduled scans, run scans automatically on a daily, weekly, or monthly cadence without lifting a finger.
    • Continuous monitoring, track how a target changes from one scan to the next and get notified when something new appears.

  11. REST API & API keys

    • REST API & API keys, create scans, retrieve results, and manage targets programmatically, so OnScanner drops into your own pipelines and tooling.

  12. Reporting & exports

    • Reporting, clean machine-readable output for your own tooling, PDF export for sharing, and embeddable security badges you can put on your site.

  13. Privacy scanning launch

    • Privacy scanning, detect over 40 categories of trackers, ad pixels, browser-fingerprinting techniques, cookies, and consent-banner compliance, all rolled up into a single privacy score.

  14. Email security checks

    • Email security, sender-authentication checks (SPF, DKIM, and DMARC) to catch domains that could be spoofed or used for phishing.

  15. Network & transport security

    • DNS analysis, surface records, misconfigurations, and exposure across a target's domains.
    • TLS & certificate analysis, check protocol versions, certificate validity, and the common transport-security mistakes that weaken encryption.

  16. Attack-surface fingerprinting

    • Technology fingerprinting, identify the software and services a target runs, entirely from the outside.
    • WAF detection, spot the web application firewall sitting in front of a target and how it responds.

  17. Known-vulnerability matching

    • Known-vulnerability matching, map the software and versions we detect to publicly known vulnerabilities, so you learn what a target is exposed to without touching it.

  18. OnScanner enters early access

    • Core security scanning, the first release: OWASP Top 10 classes, exposed services, and common misconfigurations, all from an outside-in attacker's view.
    • Live, never-cached results, every scan runs in real time against the target and is never served from a stale cache.