qsa.sh is live. It does one thing: you run curl qsa.sh from a server, and it scans that server's public IP from the outside and streams the results straight back to your terminal.
What prompted it
We wanted a quick, honest way to check whether a box was exposing something it shouldn't be.
That question comes up constantly — after standing up a new server, after a firewall change, after inheriting infrastructure someone else configured, or just periodically because things drift. The tools to answer it already exist and are excellent: nmap, naabu, nuclei are all open source and all free. But answering that question usually means installing a toolchain somewhere, keeping template sets and CVE data current, remembering the right flags, and then reading raw output.
And there is a subtler problem: running those tools from the box you are checking tells you what the box thinks it is exposing. It does not tell you what the internet can actually reach. Firewalls, NAT, security groups and hosting-provider filtering all sit between the two. The only way to know what is reachable is to look from the outside.
So qsa.sh runs the same open-source tools a security engineer would run by hand, from outside your network, and gives you the answer in about thirty seconds with nothing to install.
The rules it plays by
The design constraint that shaped everything: it only ever scans the public IP you connect from. There is no field to type someone else's address into, because there is no way to point it at anyone else. That is what makes it safe to offer publicly.
Free scan results are not stored. What you see in your terminal is the whole record.
And when a scan cannot finish, or only covers part of your ports, the report says so. A security tool that quietly under-reports is worse than no tool at all, so we would rather tell you the check was incomplete than show you a clean result we cannot stand behind.
Free, with paid tiers to keep it running
qsa.sh is built by Tuxxin LLC, and it follows the same pattern as the rest of our tools: the useful version is free and public, with a small subscription for people who need more.
Scanning costs real money — servers, bandwidth, and the egress capacity to run port sweeps and thousands of vulnerability checks. The paid tiers exist to cover that, not to paywall the basics. The free scan is a genuine scan with real tools and real findings, not a teaser.
If it saves you one misconfigured firewall rule, it has done its job.
Run it: curl https://qsa.sh