VulnHawk is live

A $29/month vulnerability scanner built for freelancers, small agencies, and solo developers who need to scan their own sites — and hand the results to a client — without paying enterprise prices.

After months of building, I'm launching VulnHawk today.

If you've ever tried to buy a web vulnerability scanner as an individual or a small team, you already know the problem. The good ones start at $98/month (Detectify) or $399/month (Intruder). Burp Suite Professional is $499/year for a desktop seat. Acunetix is $7,000/year minimum, and you have to talk to a salesperson before they'll even quote you. Every one of those tools is excellent. None of them is priced for the person who scans two sites a month.

That's the gap VulnHawk fills.

---

What VulnHawk does

VulnHawk is a full web vulnerability scanner. You give it a URL. It crawls the site, runs 83 security checks across the OWASP Top 10 categories, and produces a report you can hand to a client.

The checks fall into ten categories:

• Reconnaissance — server fingerprinting, exposed robots.txt, sitemap discovery, TLS certificate info
• Injection — reflected XSS, SQL injection (error, boolean, time-based), command injection, SSTI, CRLF, XXE, LDAP
• Access control — open redirects, IDOR indicators, path traversal, default credentials, CORS misconfiguration, SSRF
• Misconfiguration — security headers, cookie flags, directory listing, verbose errors, exposed .env / .git files
• Cryptography — TLS versions, weak ciphers, certificate expiry, mixed content, sensitive data in URLs
• Authentication — username enumeration, session fixation, cookie entropy, JWT weakness, OAuth misconfig
• Data exposure — hardcoded secrets, source maps, internal IP leakage, debug endpoints
• Client-side — DOM sinks, postMessage handlers, missing SRI, clickjacking
• Supply chain — outdated JS libraries, CMS fingerprinting, unpinned CDN dependencies
• Logic — rate limiting, HTTP parameter pollution, mass assignment indicators

Every finding comes with the URL, the parameter, the payload (where applicable), the CWE identifier, and remediation guidance. Nothing is invented. Every finding is evidence-based.

---

What it looks like in practice

Here's a real scan against a public test target — you can download the PDF report to see the output for yourself before you sign up.

The live view during a scan:

The scan page shows the crawler working through the target in real time. Matrix-style rain, spider crawlers, live counters for pages crawled and checks run. It's decorative, but it's also genuinely useful — you can watch the scan progress instead of staring at a spinner for ten minutes.

The topology view after completion:

Once the scan finishes, you get a topology globe. Each satellite is a page, colored by the highest-severity finding on that page. Green for clean pages, amber for medium, red for high. Hovering over a node shows what was found. It's the fastest way to see where the problems are concentrated.

The report:

Seven export formats: PDF, Excel, HTML, Markdown, CSV, JSON, and SARIF. The PDF is the one most users hand to clients. It's print-friendly, branded, and includes a severity breakdown, an executive summary, and per-finding detail.

You can see the full report from the demo.testfire.net scan here.

---

Who this is for

VulnHawk is built for four groups of people:

Freelance developers and consultants. You build a site, you hand it to a client, and you want to prove you checked for the obvious things. A $29/month scanner that produces a PDF you can email is worth it. A $399/month scanner is not.

Small agencies. You manage ten sites. You need to scan them quarterly, keep an eye on the results, and have something to show clients when they ask "is our site secure?" You don't need an enterprise platform. You need a tool that works.

Solo founders and indie developers. You shipped an app. You want to know if there's anything obviously wrong with it before someone else finds out the hard way. You're not going to hire a pentester for a side project. You might pay $29/month for peace of mind.

Small dev teams. Two to five people, no dedicated security engineer. You want a scanner that's part of your workflow but not a whole platform to maintain.

---

What it does not do

I want to be honest about this, because overpromising is how security tools lose trust.

VulnHawk is not a replacement for a human pentester. Automated scanners find the known-shape vulnerabilities. A human pentester finds the business-logic flaws, the chained exploits, the things that only make sense after reading your code for a week. If you're a regulated enterprise, you need both.

VulnHawk does not exploit what it finds. It detects. It doesn't verify by actually exploiting a vulnerability. That's a deliberate choice — exploiting a production site without permission is a good way to make the news, and I'm not building a tool that does that.

VulnHawk does not do JavaScript-rendered crawling. If your site is a single-page application that renders everything client-side, the crawler will see the raw HTML and miss most of the routes. This is on the roadmap.

VulnHawk does not scan authenticated areas. You can't log in and scan behind a paywall. Also on the roadmap, also not there yet.

The check library is 83, not 7,000. Acunetix has thousands of checks. Most of them are for enterprise technologies you're not using. VulnHawk has 83 checks tuned for the sites that freelancers and small teams actually build: WordPress, Django, Rails, Next.js, standard server-rendered apps.

---

Pricing

Free tier: 5 scans a month, 25 pages per scan, four check categories (misconfiguration, headers, XSS, crypto). CSV export. Enough to see if the tool works for you.

Pro: $29 a month, or $290 a year (two months free). 200 scans a month, 1,000 pages per scan, all 83 checks, all seven export formats, scheduled recurring scans, priority queue. The full toolkit.

Admins and staff: if you have an admin account, you get Pro features automatically. No subscription needed.

Compare this to the market:

Tool	Price
VulnHawk Pro	$29/month
Detectify	~$98/month
Intruder	~$399/month
Burp Suite Professional	~$42/month (annual only)
Acunetix	~$583/month minimum (annual only)

VulnHawk is the cheapest professional scanner on the market. That's the point.

---

Why I built it

I got tired of paying enterprise prices for basic security scanning.

Not because enterprise tools are bad. Burp is excellent. Intruder is excellent. But every time I wanted to scan a small client site, I was facing a $399/month subscription or a $500/year desktop license for something I'd use once a quarter.

I built VulnHawk for myself first. It scans the sites I work on, produces the reports I need, and doesn't cost more than a couple of streaming subscriptions. Then I realized other freelancers probably have the same problem, and I decided to open it up.

VulnHawk is a solo project. It's built and maintained by one developer. That means:

• Support is direct. If you email, I answer. Not a support bot, not a ticket system.
• Roadmap is responsive. If you need a feature, I'll tell you honestly whether it's coming and when.
• Downtime is rare but possible. I don't have a 24/7 on-call rotation. If something breaks, I fix it as fast as I can.

In exchange, you get a scanner that costs one-tenth of what the enterprise tools cost, and you don't have to talk to a salesperson to try it.

---

Try it

Sign up for free and run your first scan. You'll see results in under five minutes.

If you want to see the output first, download the example report. If it looks like something you'd use, the free tier will tell you whether VulnHawk is right for you.

If you have questions, email me directly at admin@thepandadev.com. I read every message.

---

What's next

A few things already in progress:

Scan diffing. When you scan the same site twice, VulnHawk will tag findings as new, existing, or resolved. If something new appears, you'll get an email. This is the feature that turns a scanner into a monitoring tool, and it's the most requested thing so far.

Subdomain discovery. Given a domain, VulnHawk will enumerate subdomains using Certificate Transparency logs. If you own example.com, you'll be able to see everything under it that's exposed.

Web scraping as a Pro feature. Extract structured content from sites you own or have permission to scrape. Uses the same crawler engine as the scanner, produces CSV, JSON, Excel, and sitemap output.

Branded PDF reports. Upload your logo and set a company name. Your reports, your brand.

Slack and webhook notifications. Get pinged when a scheduled scan finds something new.

If any of those matter to you, reply to your welcome email and tell me. Priority gets set by who asks.

---

Thank you

If you made it to the bottom of this post, thank you. If you try VulnHawk, thank you twice. If you tell a friend, thank you three times.

Building this has been the most interesting project I've worked on, and I'm genuinely excited to see what people use it for.

— The Panda Dev