Free scan

The scan API

One endpoint. No account, no key, no signup. Send a URL, get back the same JSON security report the website produces. It is read-only and free, because understanding your own app is never the thing we gate.

Endpoint

GET  https://xlogs.com/api/v1/scan?url=<your-url> POST https://xlogs.com/api/v1/scan   { "url": "<your-url>" }

Both forms do the same thing. Use GET for a quick one-liner, POST if you would rather not put the URL in a query string.

Example

curl "https://xlogs.com/api/v1/scan?url=https://your-app.com"

Returns a JSON object with the scan result: findings (each with severity, a confidence label, CWE and OWASP tags, and a copy-paste fix), a coverage receipt, a plain verdict, the platform fingerprint, the shipped-library list, and the measured scan time. It is the exact shape the website renders.

Response shape

{
  "ok": true,
  "apiVersion": "1",
  "scannedAt": "2026-08-13T00:00:00.000Z",
  "url": "https://your-app.com",
  "reachable": true,
  "counts": { "critical": 0, "high": 0, "medium": 1, "low": 0 },
  "verdict": { "level": "issues", "headline": "..." },
  "findings": [
    {
      "vulnId": "supabase-rls",
      "severity": "critical",
      "confidence": "confirmed",
      "cwe": "CWE-284",
      "owasp": "A01:2021 Broken Access Control",
      "title": "Your database may be publicly readable",
      "fixSteps": ["..."],
      "verify": "..."
    }
  ],
  "receipt": [ { "id": "database", "status": "found" } ],
  "sbom": { "libraries": [ { "name": "react", "version": "18.2.0" } ] }
}

Rules

  • Free and unauthenticated. No key, no account. Every field is returned; nothing is gated.
  • Read-only. The API runs the same checks as the site: ordinary GET requests, no writes, no login, no exploitation.
  • Public URLs only. Private, loopback, and cloud-metadata addresses are refused, the same as the website scanner.
  • Rate limited to 60 scans per IP per hour, so it cannot be used as a scanning amplifier. Over that returns HTTP 429.
  • CORS open. You can call it from a browser tool or a dashboard.
  • Not a compliance product. The CWE and OWASP tags are for matching against other tools, not evidence for SOC 2 or PCI.

Prefer the command line?

The same checks run from a zero-dependency CLI you can drop into CI, with a deploy gate and SARIF output. See the methodology for the full list of requests either path sends.