Pricing
The same open-source tools a security engineer runs — naabu, nmap + vulners and nuclei — run for you, fast and curated. The free scan is live now; Full and Deep follow.
Scan tiers
| Free$0see what the internet sees | Full Pro$5 /mocomplete surface coverage | Deep$7 /scanuncovers what the surface hides | |
|---|---|---|---|
| Command | curl qsa.sh | curl https://qsa.sh/<token> | curl https://qsa.sh/<token> |
| Delivery | Live terminal stream | Async — returns when ready | Async — emailed report |
| Typical time | ~30 seconds | ~2–12 minutes | ~13–16 minutes |
| Scans / IP | 1 / 24h | 1 / hour | Unlimited |
| Ports (naabu) | Top 1,000 TCP | All 65,535 TCP | All 65,535 TCP |
| Service + CVE (nmap) | -sV --script vulners | -sV --script vulners | -sV --script vulners |
| Vuln checks (nuclei) | ~2,000 curated | ~2,000 curated, all ports | ~10,500 full set + custom |
| Findings shown | Ports, versions & top 3 | Full list + remediation | Full list + remediation, emailed |
| Data retention | Nothing stored | Single-read or 24h Redis · no DB | Emailed · single-read or 24h Redis · no DB |
| Run it free → | Subscribe → | Buy Deep → |
Times shown are typical, not guaranteed — a scan can take longer depending on network latency, how many ports are open, and how many checks match your services.
Powered by open-source naabu 2.6.1, nmap 7.93 + vulners and nuclei 3.3.9 with the public nuclei-templates — no proprietary, black-box software. See exactly what each tier runs →
Keep it alive: the free scan stays free because a few people chip in — no account, no subscription. (tip option — coming soon)
How paid access works
- Pay for Full or Deep (via PayPal, once switched on).
- You receive a one-time, opaque token — no account required.
- Run
curl https://qsa.sh/<token>from the server you want scanned. It always scans the connecting IP — there is no field to type a different target. - Full returns asynchronously; Deep emails the report plus a self-expiring
/r/<token>results link.
Paid results are the one exception to zero-retention — an async scan must briefly hold its result to deliver it, so it lives only in Redis (never in a database), single-read (deleted the instant the report is first opened) and otherwise auto-purged after 24 hours if never opened. Pro is not emailed — you fetch it, or cron it yourself; Deep emails you the single-read link. See the Privacy statement.
Every tier scans only the IP you connect from. Free allows 1 scan per 24 hours per IP; Full raises that to 1 every hour (key-based, enough to fix and re-verify); Deep has no per-IP cooldown — each scan is a one-time credit, bounded only by fleet capacity. Known CGNAT and mobile-carrier connections are refused, as are ones our reputation data flags as a proxy, VPN, or Tor/relay (best-effort, IPv4-only); IPv6 origins are refused for now — run curl -4 qsa.sh. Your own cloud, hosting, or datacenter IP is fine.
How it works · Terms · Privacy · Home