Most website security scanners hand you the same thing: a long list of red and yellow lines, a severity score, and good luck. "Missing Content-Security-Policy header." Great. Now what?
I wanted the "now what" part. So I built Scanwise: point it at a domain, it maps the external attack surface in one pass, and for every finding an AI advisor writes the actual fix. It gives you a ready-to-paste Nginx block, Express middleware or React change, not a link to an OWASP page.
What it actually checks
Scanwise is passive and non-exploitative on purpose. It doesn't try to break in. It looks at everything a curious outsider could already see, and it's a lot:
- DNS and email security: SPF, DMARC, DKIM, WHOIS/RDAP, IP and hosting intel
- TLS: certificate chain, protocol versions, weak configs
- Security headers: scored, not just listed
- Exposed stuff:
.envand.gitfiles, config leaks, public source maps, API keys (AWS, Stripe, GitHub) hardcoded into frontend JS bundles - CORS and GraphQL: origin reflection with credentials, introspection left on in production
- Known CVEs: tech fingerprinting cross-referenced against OSV for the stack it detects
- Disguised files: Google's Magika model flags files whose real type doesn't match their extension
That's 20+ recon modules streaming results into the UI in real time. At the end you get a report you can export as a PDF for a client or a manager.
The false positive that taught me the most
Early on, Scanwise kept screaming CRITICAL: exposed .env file at perfectly healthy sites. It turned out a lot of modern single-page apps return 200 OK with the app shell for any path. Ask for /.env and you get a lovely HTML page with a 200 status. A naive scanner reads that as "file exists."
The fix was a soft-404 detector: request a path that definitely doesn't exist first, fingerprint what "not found" looks like on that particular site, then compare. It's boring and it matters. A security tool that cries wolf gets ignored, and then it's worse than no tool at all.
Then the payment processor said no
The plan was simple: free basic scan, pay for the AI remediation, card checkout through Paddle. I even renamed the project for it. It started life as HACK.THEM.ALL, which is a great name for a side project and a terrible one for passing a merchant's compliance review.
It didn't help. Paddle declined the whole category. Tools that scan other people's websites make payment processors nervous, whatever the tool actually does. For me, "just try another processor" isn't a real option either. Card processing and my situation don't get along well in general, which is a longer story.
So Scanwise takes crypto only, via OxaPay: BTC, ETH, USDT and a few dozen other assets. That forced a rethink of the pricing too. Crypto payments are one-off and irreversible, so a subscription made no sense. For about half a day I had a "30-day Pro pass" and then deleted it, because the product sells scans, not time. Now it's plain credits:
- First scan free on sign-up, AI fix and PDF included
- $4.99 for one scan, $12.99 for five
- Pro: $49 for 25 credits, with monitoring for up to 3 domains
- Agency: $99 for 60 credits, with up to 15 domains
One credit is one full scan with AI remediation. Credits never expire. No subscription to forget about.
I audited my own security scanner. Twice.
Here's the uncomfortable part. When I sat down to review the backend properly before switching on real payments, it had no authentication. You could get free scans, a free AI advisor, other people's reports, a global list of every scan and open monitoring. It was a security scanner with the front door open.
It never saw a paying customer in that state. It was fixed the same day: auth on every route, ownership checks that return 404 instead of leaking what exists, atomic credit deduction, an SSRF guard that resolves DNS before fetching anything, rate limits and a strict CORS list. The lesson stuck, though: "it works" and "it's safe" are different claims, and a security product has to earn the second one.
So I kept going. The first full audit closed 44 issues: crash recovery for scans interrupted by a server restart, email verification so nobody farms the free credit, SSE that survives a dropped connection and more. Tests went from 89 to 123. A second round (19 more items) went deeper: a raw-socket SSRF guard, secret redaction in reports, exactly-once credit grants and refunds, scan cancellation, a single-worker lease so two processes never run the same job, CI and lint down to zero. The free starter credit is now also limited per network, because people are creative.
The last step was the least glamorous: a real crypto payment, end to end. Invoice, payment, webhook, credits landing in the dashboard, and a replayed webhook that correctly does nothing. It works.
What I'd tell myself at the start
Pick your payment rails before you pick your category. I built the product first and asked the processor second. If you're building anything security-adjacent, find out what your processor allows before you write the checkout.
Your own product is the first thing you should scan. Mine would have flagged half of what the audit found.
Passive is a feature. "Non-exploitative" isn't a limitation I'm apologizing for. It's what makes the tool safe to point at your own site on a Tuesday afternoon without calling anyone first.
Scanwise is live at scanwise.dev. The first scan is free, so point it at something you own and see what it says. If it flags something wrong, I'd genuinely like to hear about it.