What checks does UNPWNED run?

UNPWNED runs 149 bounded public checks covering externally observable headers, DNS, certificate transparency and technology signals. With current ownership verification, it unlocks up to 702 configured checks through the deep scan, including CVE fingerprinting, cloaking detection, and deeper CORS/method testing.

Is it safe to scan my domain?

Yes, the standard scan is safe. It sends non-destructive requests only to the public attack surface and never writes, modifies, or deletes data. Owner-only checks that probe paths, ports, and APIs require domain ownership verification, and the separately labeled active-testing tier requires explicit authorization.

How long does a scan take?

Most standard scans finish in a couple of minutes, while deep scans with many more checks usually take several minutes. The exact time depends on how many checks apply and how quickly the site and external APIs respond.

Can I monitor my GitHub repositories?

Yes, UNPWNED offers GitHub repository monitoring on paid plans. Connect your GitHub account via OAuth, select repositories to monitor, and UNPWNED runs scheduled scans checking for 49 credential patterns, vulnerable dependencies, and exposed config files like .env and credentials.json, notifying you via email and webhooks.

UNPWNED is built for solo developers, indie hackers, and small teams shipping fast - especially developers who build with AI coding tools (Cursor, Lovable, Bolt, Replit, v0, Base44, Windsurf). It is also useful for SaaS founders running a pre-launch security check, agencies validating client work before handover, and Supabase or Firebase users who need to confirm their RLS rules and storage policies are tight.

Cybersecurity

UNPWNED

Outside-in web security scanner for AI-built apps and indie developers

0 votes. Log in to rate UNPWNED up Follow change log. Log in to follow UNPWNED's change log

Web security scanner that runs 149 free checks and up to 702 deep checks, with AI-ready fix prompts for paid plans starting at $9/month.

Overview

A look at unpwned.io

UNPWNED is an outside-in web security scanner designed for solo developers, indie hackers, and small teams building with AI tools. It scans live websites and GitHub repositories to identify security issues including SSL/TLS configuration, HTTP security headers, exposed secrets, Supabase and Firebase access problems, API routes, CORS issues, DNS and email authentication, open ports, and CVEs.

The free plan includes 149 bounded public checks and shows what is wrong. Paid plans from $9/month provide full details, AI-ready fix prompts tailored to specific tools like Next.js, unlimited re-scans, monitoring, and deep scans with up to 702 configured checks after domain ownership verification.

UNPWNED is built specifically for code generated by AI tools, which has a distinct vulnerability profile compared to hand-written code. It is designed to catch security mistakes that slip into fast-moving and AI-assisted builds, such as exposed keys, missing RLS rules, hardcoded credentials, and open CORS.

The scanner is safe to use: standard scans send non-destructive requests only to the public attack surface and never write, modify, or delete data. UNPWNED is not a penetration test replacement but serves as a pre-launch baseline for common externally observable issues.

Feature notes

Up to 702 configured deep checks after domain ownership verification
SSL/TLS certificate analysis and security headers audit
Leaked API key and exposed secrets detection
GitHub repository monitoring with OAuth integration
AI-ready fix prompts for paid plans
PDF export and security badge for verified domains
Monitoring and CVE alerts
Before/after diff verification for fixes
Open endpoint discovery and sensitive file detection

Pricing

Free: up to 2 domains, 2 scans per month. Solo: $9/month for 1 protected domain, unlimited re-scans. Studio: $29/month for 5 protected domains. Scale: $49/month for 15 protected domains. Annual plans available with 2 months free.

Follow change log. Log in to follow UNPWNED's change log

Follow UNPWNED to get an email when they post a milestone, ship a new product or add a demo video.

UNPWNED at a glance

Community votes: 0
Followers: 0
HQ: Israel

UNPWNED metrics

Inspection sheet for unpwned.io: Ahrefs Domain Rating and Majestic link metrics, with the delta since the last inspection.
Metric	Value
Domain Rating	8 no change since last check
Trust Flow	3 no change since last check
Citation Flow	23 no change since last check
Referring domains	22 no change since last check
External backlinks	93 no change since last check

Domain Rating by Ahrefs inspected 6 Nov 2026, adjusted 4 Nov 2026. Primary topic: Regional/Asia (3). Majestic inspected 4 Nov 2026, adjusted 4 Nov 2026. Link data: Majestic. Trust Flow, Citation Flow and Topical Trust Flow are trademarks of Majestic-12 Ltd.

UNPWNED domain diagnostics

Run through the diagnostics

Public RDAP record, last read 6 Nov 2026, 03:26 UTC.
Domain age	8 months
Registered	26 Feb 2026
Expires	26 Feb 2027
Registrar	Cloudflare, Inc
DNSSEC	Signed

Run the full check on unpwned.io

UNPWNED post-launch diagnostics

Measured after UNPWNED went live on Launching Pro on 4 November 2026.

Domain Rating (Ahrefs): 8 no change since launch; 8 at launch (4 Nov 2026), 8 on 6 Nov 2026
Trust Flow (Majestic): 3; First measured 4 Nov 2026
Referring domains (Majestic): 22; First measured 4 Nov 2026

Day 2 since launch. Next receipt: day 30, 4 Dec 2026. The figures report a change; they do not say what caused it, and many things can. No figure here is a guess.

Biggest gains on Launching Pro

Team

Raz AzulayFounder

Launch tips, free to read

The playbook on Launching Pro lists what to prepare, what to post on launch day and where else to list your product.

Before the day
Launch day
That week
Beyond launch

See the launch playbook

Compare and explore

FAQ

What checks does UNPWNED run?: UNPWNED runs 149 bounded public checks covering externally observable headers, DNS, certificate transparency and technology signals. With current ownership verification, it unlocks up to 702 configured checks through the deep scan, including CVE fingerprinting, cloaking detection, and deeper CORS/method testing.
Is it safe to scan my domain?: Yes, the standard scan is safe. It sends non-destructive requests only to the public attack surface and never writes, modifies, or deletes data. Owner-only checks that probe paths, ports, and APIs require domain ownership verification, and the separately labeled active-testing tier requires explicit authorization.
How long does a scan take?: Most standard scans finish in a couple of minutes, while deep scans with many more checks usually take several minutes. The exact time depends on how many checks apply and how quickly the site and external APIs respond.
Can I monitor my GitHub repositories?: Yes, UNPWNED offers GitHub repository monitoring on paid plans. Connect your GitHub account via OAuth, select repositories to monitor, and UNPWNED runs scheduled scans checking for 49 credential patterns, vulnerable dependencies, and exposed config files like .env and credentials.json, notifying you via email and webhooks.
Who is UNPWNED for?: UNPWNED is built for solo developers, indie hackers, and small teams shipping fast - especially developers who build with AI coding tools (Cursor, Lovable, Bolt, Replit, v0, Base44, Windsurf). It is also useful for SaaS founders running a pre-launch security check, agencies validating client work before handover, and Supabase or Firebase users who need to confirm their RLS rules and storage policies are tight.

Leave a review for UNPWNED

No reviews of UNPWNED yet. Run the first inspection.

Reviews are free and are never paid for. Open the reviews

Reviews and notes · Change log · Share the profile · Maker of this product? Claim the profile · Report a fault

Comparable tools

Bugcrowd0 community votes
DivoltDR 18 · 0 community votes
StealthMoleDR 33 · 0 community votes
mlab.shDR 26 · 0 community votes

Feature notes

Pricing

Compare and explore

Leave a review for UNPWNED

More on this profile