VulnRadar

Open-source web vulnerability scanner. Paste a URL and get 855+ deterministic checks back, each with the response evidence behind it, a finding ID that does not change between runs, and the config line that fixes it. No agent to install. GPL-3.0 and self-hostable.

Scan a URL with no account · Docs · Self-host · Changelog

What it does

• Stable finding IDs, so two runs can be diffed and a CI job can fail on exactly the finding you care about instead of a severity count
• Evidence with every finding: the header, the certificate field, or the response body fragment that triggered it, not just a rule name
• 18 categories covering security headers, TLS and certificates, cookies, DNS and email records, exposed secrets, server misconfiguration, information disclosure, client-side risks, supply chain exposure, and common AI-generated code antipatterns
• A CLI and a GitHub Action that poll a scan to completion and exit non-zero when findings cross a threshold you set
• A self-updating embed badge: generate it once and it always shows that URL's most recent completed scan, with no new embed code to paste
• Scan diffing and shareable report links, so a fix can be shown to have landed rather than asserted
• Scheduled scans, bulk scanning, and signed webhooks that fire when the scan actually finishes rather than when the request that started it returned, on every kind of scan: single URL, crawl, bulk, authenticated, and GitHub repo. A scan.regressed event carries the findings that are new since the previous scan of the same target, so an alert can be routed to a person without a second API call
• Exports to PDF, JSON, CSV, SARIF, Markdown, or a compliance crosswalk, so findings go into the tool your team already uses
• A browser extension for Chrome and Firefox that scans the tab you are on
• Runs on your own hardware under GPL-3.0, with no telemetry. The only outbound call it makes on its own behalf is the admin-triggered update check against the GitHub releases API

Auth, teams, billing, the admin panel and the AI triage assistant are all covered in the docs.

Quick Links

• Documentation - setup, API reference, and guides
• GitHub - source and contribution guidelines
• Report a Bug - help us improve
• Security Advisories - privately report a vulnerability
• Support VulnRadar - pays for hosting the public instance and the time spent chasing false positives out of the detection engine

Embeddable Badge

The badge above is generated once and updates on its own: scan your site again and the image changes with it, no new embed code to paste in. Pick a scan at /badge, copy the HTML or Markdown snippet, and the badge always reflects that URL's most recent completed scan, not the scan you happened to pick when you made it.

Getting Started (Hosted)

1. Try it without an account at /demo
2. Sign up at vulnradar.dev/signup for 25 scans a day, free
3. Read the docs at /docs for the API and advanced features

Self-Hosting

VulnRadar is GPL-3.0 and can be self-hosted. See the Self-Hosting Guide for full instructions.

# 1. Clone
git clone https://github.com/VulnRadar/vulnradar.dev.git
cd vulnradar.dev

# 2. Configure
cp .env.example .env
# Set DATABASE_URL and API_KEY_ENCRYPTION_KEY in .env. App name, URL, emails
# and branding are build-tier: edit lib/config/config-values.ts and rebuild.
# Rate limits, feature flags and billing limits are runtime-tier: change them
# in Admin -> Settings after the first sign-in, no rebuild needed.

# 3. Build and run. The schema creates itself on first boot; there is no
#    separate init step.
docker compose up -d

API_KEY_ENCRYPTION_KEY is required. Without it the app refuses to store TOTP secrets rather than falling back to plaintext.

Configuration

Every setting resolves as database ?? environment ?? shipped default (see the Config Reference for every value):

Layer	Where	Purpose
Database	Admin -> Settings	Wins over everything else. No restart, no rebuild: a change reaches every running instance within the 30 second resolver cache.
Environment	.env (or docker-compose.yml env)	A variable named exactly like the registry key pins a value without a database write. Also where secrets live.
Shipped default	lib/config/config-values.ts	The CONFIG_* constant the repo ships with. Edit and rebuild.

Most of the settings in lib/config/registry.ts are runtime tier and take effect as soon as they are saved. The rest are build tier (app name, branding, SEO metadata) and are baked into statically generated pages, so those need a rebuild before the change is visible. /docs/config counts both from the registry itself and is the number to trust: the figures that used to be written out here had drifted by nine as settings were added, which is the same reason that page computes them rather than stating them.

Secrets are environment-only and have no admin control: DATABASE_URL, API_KEY_ENCRYPTION_KEY, STRIPE_SECRET_KEY, SMTP credentials, Discord OAuth.

How a value gets read: lib/config/config-values.ts exports the raw CONFIG_* constants. lib/config/registry.ts classifies each one into SETTINGS_REGISTRY (type, bounds, admin tab, tier). lib/config/runtime-config.ts resolves it in the order above, and lib/config/constants.ts / client-constants.ts re-export the results under the conventional names (APP_NAME, ROUTES, API, ERROR_MESSAGES) used throughout the app. lib/config/env.ts validates the required environment variables with Zod at boot.

Architecture

See docs/architecture for:

• Project structure (app/, lib/, components/, hooks/, tests/)
• Configuration system (above)
• Database layer (PostgreSQL via the pg driver)
• Authentication flow (sessions, 2FA, API keys)
• Scanner engine and how to add a check category
• REST API (v3)
• CI/CD pipeline (GitHub Actions + Dependabot)

Development

Prerequisites: Node 22 LTS (the engines field is >=22.0.0 <23.0.0, so Node 20 and every release from 23 up fail the check outright; see .nvmrc) and PostgreSQL 14+.

npm ci
cp .env.example .env
npm run dev

Use npm ci, not npm install. Regenerating package-lock.json on Windows or macOS drops the Linux native bindings and breaks CI and the Docker build. See CONTRIBUTING.md.

Script	Purpose
npm run dev	Development server
npm run build	Production build
npm run typecheck	tsc --noEmit
npm run lint	ESLint, including type-aware rules on auth code
npm run format	Prettier
npm run format:check	Prettier in check mode. CI gates on this
npm test	Vitest suite
npm run test:coverage	Vitest with per-file coverage thresholds
npm run build:knowledge	Regenerate lib/ai/ from the docs, changelog, checks, legal
npm run db:migrate	Apply schema migrations
npm run db:create	Clone the DB to a new name at a chosen schema version
npm run db:diagnose	Read-only database corruption report. db:repair fixes
npm run db:backup	Full dump. db:restore puts one back

Tests live in tests/, mirroring the source tree. See tests/README.md for the layout and conventions.

See CONTRIBUTING.md for commit conventions and the pull request process.

Tech Stack

• Framework: Next.js 15.5 (App Router)
• UI: React 19, TypeScript 6, Tailwind CSS 4, Radix UI primitives
• Database: PostgreSQL via the pg driver
• Auth: HTTP-only session cookies, scrypt password hashing (N=2^17, params stored per hash so the cost can be raised without invalidating old hashes), custom TOTP (RFC 6238), bcrypt for API key hashing
• Payments: Stripe (Elements)
• Scanner: Custom TypeScript engine over HTTP/HTTPS/WebSocket/FTP
• Testing: Vitest
• CI: GitHub Actions + Dependabot

Security

• Security Policy
• security.txt
• Dependency Scanning

To report a vulnerability, email security@vulnradar.dev. Please do not open a public issue.

License

GPL-3.0. See LICENSE for the full text.