Changelog

What's new

OnScanner has been in development since 2023 and scanning live targets since 2024. A running log of the major releases along the way, newest first. Routine fixes and smaller improvements are left out.

Scan my site Read the methodology

  1. Compliance evidence, consent signals and the deployment gate

    • Compliance evidence mapping: a rule engine maps each scan's evidence to controls in SOC 2, ISO 27001, GDPR, PCI DSS, HIPAA, US state privacy (CCPA/CPRA) and the EU Cyber Resilience Act (CRA). Verdicts come from versioned rules, never from a model, and a failing control always cites what the scan observed. Coverage is shown honestly: 25 of the 229 controls across the seven frameworks can be checked from outside, and the rest are marked as needing your own evidence. It describes the site at the time of the scan and is not a certification. Optional: an account owner or admin turns it on in account settings, and it adds 2 credits to each scan that uses it. See compliance reports.
    • Evidence binder and export: a PDF evidence binder that opens with what the scan could not evaluate, plus the control matrix as JSON and in the format Vanta's custom resource API accepts, which you send with your own Vanta token.
    • Remediation plans: security header and TLS configuration for nginx, Apache, Caddy, Cloudflare and Next.js, a Content-Security-Policy built from the origins the scan actually saw, and per-tracker consent guidance.
    • Global Privacy Control checks: advanced and deep privacy scans now load the site a second time with the GPC signal on and compare trackers and cookies against the normal visit, so you can see whether the opt-out is honored.
    • Consent precision: Google Consent Mode pings sent with consent denied and no identifiers now count as respecting the refusal instead of as tracking, and privacy policy discovery understands EU and Nordic link text.
    • Consent Verification Report: a fixed-price consent and tracker audit of one domain ($149, outside the credit system) that compares Accept all with Reject all, checks Global Privacy Control handling and inventories trackers, delivered as a dated PDF in 2 business days. See the Consent Verification Report.
    • Deployment gate: compare a preview or staging scan with a production baseline across security headers, TLS, exposed paths, third-party trackers and OWASP finding families, for a pass, regressed or inconclusive verdict. Available through the REST API and to AI agents over MCP, and it costs no credits beyond the scan.
    • Compliance for AI agents and monitoring: a new MCP tool reads a scan's compliance matrix, and monitoring diffs now show when failing controls go up or down between runs.
    • Agency sub-accounts: client sub-accounts that spend one parent credit wallet, with each client's scans kept separate, and PDF reports carrying your company name and logo. API only for now, enabled per account.
    • SARIF export and request smuggling: scan findings export as SARIF 2.1.0 through the API, and the OWASP scanner confirms HTTP request smuggling and HTTP/2 desync issues before reporting them.

  2. API security and wider exploit coverage

    • OWASP API Security Top 10: API findings are now reported against the OWASP API Security Top 10 alongside the web Top 10, with stronger broken function-level authorization checks and deeper GraphQL testing.
    • More active exploit checks: new safe, in-band checks for widely exploited 2025 and 2026 vulnerabilities, many of them on the CISA KEV catalog, across products such as Ivanti, SharePoint, Fortinet, Citrix, SAP NetWeaver and Apache Tomcat.
    • Exploitability tiers for CVEs: each matched CVE now carries an exploitability tier, and a CVE that only applies under a configuration a version banner cannot reveal is marked conditional instead of being reported as certain.
    • Sharper misconfiguration checks: more exposed-actuator and content probes, broader SSRF and insecure design checks, and more reliable TCP port scanning with retry and rate-limit detection.
    • Cleaner results: cookies a site deletes are no longer counted as set, WAF results are grouped per host, and technology detection no longer fingerprints a different site reached through an off-domain redirect.

  3. Authenticated scanning and account security

    • Authenticated scanning: scan the application behind the login while keeping the attacker's outside-in view. Provide a session cookie, bearer token, or basic auth for a one-off scan, or save a form login or recorded sign-in per target (encrypted at rest) so repeat scans, monitors, and schedules authenticate on their own.
    • Deeper authenticated checks: the scanner confirms the login before scanning, explores the post-login application, discovers access-gated API definitions, and tests write paths and cross-account access using a second identity.
    • Two-factor authentication (2FA): protect sign-in with a 6-digit code from an authenticator app, backed by one-time recovery codes and a secure reset flow. Changing your password now ends every existing session.
    • Guides and comparisons: practical write-ups on the blog and source-linked comparisons with the major commercial scanners.
    • Email security in context: sender-authentication checks (SPF, DKIM, DMARC) are now subdomain-aware, and targets that don't handle email are marked not applicable instead of flagged.

  4. AI Findings

    • AI Findings: optional analysis on top of a scan that summarizes results, explains each issue in plain language, recommends fixes, and correlates related issues into attack chains and a MITRE ATT&CK kill chain. It is grounded against your actual scan, so it can't invent issues or understate severity. Optional: an account owner or admin turns it on in account settings, and it adds 1 credit to each scan that uses it.
    • Scan-completion notifications: an email the moment monitors and scheduled scans finish.

  5. AI agents

    • Run scans from your AI agent: kick off scans and read results directly from Claude, Cursor, and other compatible AI assistants, with discovery built in so an agent can find and use OnScanner on its own. Access is always tied to your own account and permissions.

  6. Monitoring overhaul and privacy precision

    • Monitoring overhaul: a current-posture scorecard at a glance, clearer change detection between scans, and automatic reclassification of issues as they get fixed over time.
    • Privacy scanner precision: far fewer false positives across consent banners, session recorders, and first-party scripts, with stricter evidence-based scoring.

  7. End-of-life detection

    • End-of-life (EOL) detection: flag products and versions past end-of-life that no longer receive security support, separate from individual known vulnerabilities, so aging software gets surfaced even when it has no open CVE yet.

  8. Active exploitation probes

    • Active exploitation probes: safe, non-destructive, in-band verification of whether a known vulnerability is actually exploitable on targets you're authorized to test. This separates real, reachable risk from version numbers that merely look vulnerable.

  9. Team accounts and billing

    • Team accounts and roles: Owner, Admin, and Member roles for shared accounts, with login history and audit context so you can see who did what.
    • Subscriptions and credits: plans, per-scan credits, one-time top-ups, and auto-refill, so scanning scales with how much you actually use.

  10. Vulnerability prioritization

    • Exploit-based prioritization: rank findings by their exploit-prediction score and flag the ones on the authoritative catalog of vulnerabilities known to be exploited in the wild, so the most urgent issues rise to the top.
    • Patch-status detection: distinguish patched, unpatched, and won't-fix issues, so you act on what's actually fixable instead of chasing noise.

  11. Sharper fingerprinting

    • Fingerprinting confidence: a confidence level for every detected technology, backed by authoritative product identifiers and extra matching signals to cut guesswork and reduce misidentification.

  12. Scheduled scans and monitoring

    • Scheduled scans: run scans automatically on a daily, weekly, or monthly cadence without lifting a finger.
    • Continuous monitoring: track how a target changes from one scan to the next and see what is new since the last run.

  13. REST API and API keys

    • REST API and API keys: create scans, retrieve results, and manage targets programmatically, so OnScanner drops into your own pipelines and tooling.

  14. Reporting and exports

    • Reporting: clean machine-readable output for your own tooling, plus PDF export for sharing.

  15. Privacy scanning launch

    • Privacy scanning: detect over 40 categories of trackers, ad pixels, browser-fingerprinting techniques, cookies, and consent-banner behavior, all rolled up into a single privacy score.

  16. Email security checks

    • Email security: sender-authentication checks (SPF, DKIM, and DMARC) to catch domains that could be spoofed or used for phishing.

  17. Network and transport security

    • DNS analysis: surface records, misconfigurations, and exposure across a target's domains.
    • TLS and certificate analysis: check protocol versions, certificate validity, and the common transport-security mistakes that weaken encryption.

  18. Attack-surface fingerprinting

    • Technology fingerprinting: identify the software and services a target runs, entirely from the outside.
    • WAF detection: spot the web application firewall sitting in front of a target and how it responds.

  19. Known-vulnerability matching

    • Known-vulnerability matching: map the software and versions we detect to publicly known vulnerabilities, so you learn what a target is exposed to without touching it.

  20. OnScanner enters early access

    • Core security scanning: the first release, covering OWASP Top 10 classes, exposed services, and common misconfigurations, all from an outside-in attacker's view.
    • Live, never-cached results: every scan runs in real time against the target and is never served from a stale cache.