YOUR EXTERNAL SECURITY WORKSPACE

Your external exposure.
Clearly understood.

Organize your websites, define scan scope, and review findings with the evidence behind them. One workspace for a clear view of external exposure.

Adding a website creates an inventory entry. You authorize each scan.

Explore the workspace
scan.host / overviewDEMO
NORTHSTAR / DEMO PROJECT

Overview

Fix first

View all →
3
Critical
5
High
Admin data accessible without sign-inCritical · api.northstar.example
Private document accessible across accountsCritical · app.northstar.example

Scan activity

View all →
32
Targets
0
Running
northstar.exampleCompleted · 12:10
Network assetsCompleted · 12:00

Illustrative workspace. No live scans or real findings shown.

INVENTORY · SCOPE · EVIDENCE
Build your inventory today.Live checks are coming with our qa.pro connection.
Explore coverage

01 / WORKFLOW

From asset inventory
to actionable findings.

One connected workflow, from the assets you own to the evidence you can act on.

01 ORGANIZE

Maintain your inventory

Organize websites by project. Keep asset details, saved scope, and scan history in one place.

Your assets, organized
02 CHECK

Define the scan scope

Select exact URLs and the checks you need. Review the scope and authorize each individual run.

Explicit scope, every time
03 INVESTIGATE

Review findings in context

See the target, the finding, and the reason it matters. Track a finding through investigation and resolution.

A clear next step

02 / EVIDENCE

Findings backed
by recorded evidence.

HTTP responses and browser captures belong beside the finding, with the original scope always in view.

HTTP EVIDENCE

HTTP response evidence

Review security headers, HTTPS delivery, and cookie attributes for the URLs you choose.

Response previewEXAMPLE
HTTP/2 200 OK
content-type: text/html
strict-transport-security:
  max-age=31536000
x-content-type-options: nosniff
BROWSER EVIDENCE

Browser capture evidence

Browser screenshots stay with the exact scan that produced them. Open the capture and investigate in context.

Focused on public websites. Network testing, schedules, and signed-in scans are not available in V1.

Evidence powered by qa.pro ↗

03 / OPERATING PRINCIPLES

Clear scope.
Traceable results.

Explicit coverage

An unfinished check never becomes a pass. Coverage stays visible alongside every result.

Verification status

A discovered hostname or an IP address is inventory, not proof of a vulnerability.

Project context

Separate your websites and client portfolios into projects, each with its own scope and history.

PRODUCT DETAILS

Frequently asked questions

What can I use right now?

Create an account, organize projects, add websites and manage saved scope. Live scanning will become available when the qa.pro connection is ready.

Does adding a website start a scan?

No. Adding a website only saves it in your inventory. Each scan requires you to review exact targets, choose checks, and confirm you have permission to test them.

What does qa.pro provide?

qa.pro is the exclusive provider for HTTP captures and browser screenshots. scan.host brings those results together with your inventory, scan history, and findings. Your scan.host account is separate from qa.pro.

YOUR NEXT STEP

Establish your
asset inventory.

Create a project, add your websites, and define their scope.

Create your workspace