See what an attacker sees.

A free scan reads your stack and matches it to known vulnerabilities. The full scan sends an AI red team to find out what is reachable.

Free scan at launch, one per domain. No card.
Example report

One URL in.
A fix list out.

Paste your URLSign in, no passwordAdd one DNS recordPick a finding
newly.app Free scan 5 technologies · 4 known vulnerabilities
AI red team: not runThe full scan finds out whether any of this is reachable.
Critical CVE-2025-29927
Next.js 13.4.19 can skip your middleware checks
A crafted request header bypasses middleware, which includes login checks. Fixed in 13.5.9, 14.2.25 and 15.2.3.
Fix npm install next@13.5.9
Prompt for your agent

newly.app runs Next.js 13.4.19, which is affected by CVE-2025-29927. Upgrade to 13.5.9 or later in this repo, run the tests, and check that every route that relies on middleware still behaves.

Full scan · AI red team

The free scan tells you what's affected. The full scan finds out what's reachable.

  1. 01 Map. Lists every page, route and service it can reach from outside.
  2. 02 Plan. Ranks the paths worth trying, starting from what the scans found.
  3. 03 Chain. Links small findings into one path an outsider could use.
  4. 04 Prove. Shows access once, with evidence.
  5. 05 Stop. Stops there and writes up the path and the fix.

It never deletes, changes or downloads your data. Every step it took is in your report.

Get early access
Pricing

First scan is on us.

Both start the same way: sign in and verify your domain.

Check
Free $0 One per domain Get early access
Full $100 Per scan Get early access
Free: $0, one per domain. Full: $100 per scan.
Included in the free scan
Tech fingerprintingFrameworks, servers and libraries, with versions
Known vulnerabilitiesDetected versions matched against public CVEs
Exposed files.git, .env, backups and open directory listings
Secrets in JavaScriptAPI keys and tokens shipped in your bundles
Source mapsReadable source code shipped to production
Security headersCSP, HSTS, frame, referrer and permissions policy
TLS and certificatesProtocols, weak ciphers, chain and expiry
Email securitySPF, DKIM and DMARC
Open portsDatabases and services reachable from the internet
Subdomain takeoverRecords pointing at services you no longer own
Admin and debug routesPanels, consoles and debug pages left online
Cookies and sessionsSecure, HttpOnly and SameSite flags
CORSOrigins allowed to read your API responses
Open redirectsLinks that bounce users to any site
API endpointsUnauthenticated routes and verbose errors
AI red teamChains findings into a path, proves access once, stops and reports

Questions

When can I use it?

Scans open to the waitlist first. Leave your email and we'll write when yours is ready.

How does the free scan work without AI?

It identifies the technologies your site serves, the way Wappalyzer does, then looks each version up in public vulnerability records. It is a lookup, so it can say a version is affected but not whether your setup is exposed.

What does the AI red team do?

It looks for a path an outsider could use. When it finds one, it proves access once, stops and reports. Every step it took is in your report.

Why do I have to verify my domain?

So nobody can point us at a site that isn't theirs. You add one DNS record and we check it.

Can a scan break my site?

No. Requests are rate limited, and the red team is never allowed to delete, change or download your data.

Do I need a password?

No. Sign in with Google or GitHub, or we email you a six digit code.

Find it before
they do.

Free scan at launch, one per domain. No card.