# SecurityScanner

> AI-powered web security scanner. 10-module audit mapped to OWASP Top 10 2025. Get a 0–100 security score, prioritized vulnerability findings, and stack-aware AI code fixes in 60 seconds.

## Pages
- [Home](https://www.inscan.space): Landing page and scan trigger — paste any public URL to start a 10-module OWASP audit.
- [Features](https://www.inscan.space/features): All 10 security modules with OWASP mapping, how-it-works steps, and per-module FAQs.
- [Pricing](https://www.inscan.space/pricing): Free, Pro ($19/mo), and Business ($99/mo) plans with a 14-day trial on paid tiers.
- [Privacy](https://www.inscan.space/privacy): Data handling policy — guest scans are not retained beyond 30 days.
- [Terms](https://www.inscan.space/terms): Terms of service.

## Modules
- [Security Headers](https://www.inscan.space/features#mod-securityHeaders): A Content Security Policy is an HTTP response header that tells the browser which sources of scripts, styles, images, and other resources are allowed to load.
- [TLS / SSL Audit](https://www.inscan.space/features#mod-tlsAudit): SecurityScanner's TLS module validates the certificate chain, expiry date, signature algorithm, and issuer trust for any public URL.
- [XSS Detection](https://www.inscan.space/features#mod-xssProbe): Reflected cross-site scripting happens when user input from a URL parameter or form field is rendered in the page response without proper sanitization.
- [SQL Injection Testing](https://www.inscan.space/features#mod-sqliProbe): SQL injection (SQLi) happens when attacker-controlled input is concatenated into a SQL query, letting the attacker alter the query's structure.
- [Secrets Detection](https://www.inscan.space/features#mod-secretsDetection): SecurityScanner detects AWS access keys, Stripe secret keys, GitHub tokens, Slack tokens, Google API keys, private keys (RSA, OpenSSH), JWT signing secrets, OAuth client secrets, and database connection strings.
- [CORS Audit](https://www.inscan.space/features#mod-corsAudit): Cross-Origin Resource Sharing (CORS) controls which domains can call your API from a browser.
- [Cookie Security](https://www.inscan.space/features#mod-cookieSecurity): `Secure` blocks the cookie from being sent over plain HTTP.
- [Sensitive Path Discovery](https://www.inscan.space/features#mod-sensitivePaths): Sensitive paths are URLs that should never be reachable from the public internet: `.env` files, `.git` directories, backup files (`.bak`, `.sql`, `.tar.gz`), admin panels, phpinfo pages, server-status endpoints, and debug routes.
- [Port Scan](https://www.inscan.space/features#mod-portScan): For a typical web server: 80 (HTTP, redirects to HTTPS), 443 (HTTPS).
- [JavaScript CVE Scan](https://www.inscan.space/features#mod-jsCveScan): A06 covers known vulnerabilities in third-party libraries, frameworks, and runtime dependencies.

## MCP server integration (added 2026-08-22)
SecurityScanner exposes a public MCP server (mcp.inscan.space) with 5 tools:
scan_target, get_scan_status, list_findings, propose_fix, apply_fix.
Compatible with Cursor, Claude Code, Windsurf, and GitHub Copilot Chat
(via CLI wrapper). Open source under MIT.
See /integrations/ai-edits for setup.