About ScanBastion

ScanBastion is a hosted website vulnerability scanner being built for the people who look after several websites at once: web agencies, freelance developers and independent security consultants. It is in development and not yet open to users. Join early access to hear when it is ready.

What we are building

A single workspace where you add the domains you manage, prove you are authorized to assess them, run a scan with a defined scope, and get findings with evidence and a recommended fix. When a client asks "is our site secure?", you can answer with a PDF report that states what was checked, what was found, and what the scan could not see.

Under the hood, ScanBastion is planned to orchestrate well-known open-source checks rather than invent its own scanner: HTTP security-header and TLS analysis, passive OWASP ZAP assessment, and a curated set of Nuclei templates. The value is in verification, bounded scan profiles, consolidated results and readable reports, not in a secret engine.

Why it exists

Most vulnerability-scanning products are designed and priced for in-house security teams. An agency maintaining thirty client sites, or a consultant doing a first pass before a manual test, rarely needs that. What they need is a tool that is honest about its limits, safe to point at a production site, and produces something a non-technical client can read.

The alternative today is a patchwork: a command-line scanner on a laptop, a headers checker in a browser tab, a TLS test on a third-party site, and a report assembled by hand. ScanBastion is meant to replace that patchwork with one repeatable workflow.

Principles

• Authorized targets only. No scan starts until domain control or explicit authorization is confirmed. Our Responsible Scanning Policy describes how.
• Bounded by design. Each scan profile has defined checks, request-rate limits and timeouts, and you can stop a scan at any stage.
• Evidence before verdicts. Severity, confidence and verification status are shown separately, so a high-severity detection is never mistaken for a confirmed vulnerability.
• Honest about limits. Automated scanning is not a penetration test. Reports say what was not covered, and a clean report never claims a site is free of vulnerabilities.
• Minimal data. This website sets no cookies, and counts visits with cookieless Ahrefs Web Analytics. See the Privacy Policy.

Where things stand

The product is pre-launch. Everything described on this site is planned for the first release and may change. The first release is not planned to include active ZAP scanning, authenticated testing, port scanning or scheduled rescans. There is no launch date yet.

Who is behind it

ScanBastion is designed and built by C. Kerger, Founder, working from San Francisco, California. It is an independent project, not a product of a larger security vendor, and the scope described on this site is the scope one small team can build well: verification, bounded scanning, consolidated findings and honest reports, on top of open-source engines that are already trusted.

ScanBastion is operated by C. Kerger, 2476 Winifred Way, San Francisco, CA 94102, United States. The postal address and all contact routes are on the contact page.

Questions, partnership ideas or feedback on the planned scope are welcome at info@scanbastion.com. If you run an agency or consultancy and would be willing to talk about how you assess client sites today, that conversation shapes the first release more than anything else.

Read more

• What each scan engine checks: headers, TLS, passive OWASP ZAP and curated Nuclei, with limits.
• Guides on reading scanner findings, domain verification, false positives and more.
• The Responsible Scanning Policy, which every scan will be bound by.