Three changes landed on the scan engine this week: a new toolchain you can try today, a rebuilt time budget that stops long scans being cut off mid-run, and a new origin-intelligence block at the top of every scan.
A newer toolchain — now live
qsa.sh runs the same open-source tools a security engineer would run by hand, so keeping them current is the product. Two big steps are ready:
- nmap 7.93 to 7.99 — built from source with OpenSSL, so the TLS and certificate scripts we rely on come with it.
- nuclei 3.3.9 to 3.11.1 — eight releases forward, with a freshly rebuilt template set and re-curated check lists.
Rather than swap the engine underneath live scans, both were installed alongside the old ones and run opt-in per scan while we proved them against real traffic. That validation is done, and both are now the default for every scan — no flag needed. The ?beta=1 path stays in place for the next upgrade:
curl https://qsa.sh?beta=1curl https://qsa.sh/{token}?beta=1for a Full or Deep scan
A beta scan says so in its output and names the exact versions it ran, so results are never mistaken for the live engine. That is how these two were promoted: side-by-side runs against a real 22-port host, confirming the new engine returned the same ports, the same 26 CVEs with matching CVSS scores, and the same TLS detail as the old one before it replaced it. If a scan ever looks wrong to you, tell us.
Honest time budgets
Every scan runs against a wall-clock cap. Previously the per-check budget could be larger than the cap itself, which meant a busy host with many open ports could be cut off mid-scan rather than finishing what it could and saying so.
Checks are now budgeted against the time actually remaining on the clock. A fast port sweep hands its unused time to the vulnerability checks; a slow one borrows from them. Two consequences worth knowing:
- Scans that used to run out of road now finish.
- When there genuinely is not enough time, the report says the checks were incomplete instead of showing a clean bill of health. A scan we could not finish will never be presented as "nothing found".
That second point matters more than the speed. A security tool that quietly under-reports is worse than one that admits what it missed.
Origin intel on every scan
Every scan now opens with a short profile of the address being scanned — the network and operator it belongs to, its country, its netblock, and its reverse DNS along with whether that rDNS is forward-confirmed (the hostname resolves back to the same address).
It is a fast way to confirm the target really is yours before the countdown ends, and forward-confirmation is a genuine trust signal that is easy to miss by eye.
That enrichment is provided by worldip.io, whose keyless IP profile API supplies the ASN, organisation, geolocation and DNS data. It costs you nothing and adds no delay to the scan itself.
Unchanged
Everything the scan does not do is still true: it only ever scans the public IP you connect from, there is no field to point it somewhere else, and free scan results are not stored.