19 vulnerability scanner engines

Web Vulnerability Scanner

Runs authenticated or anonymous OWASP-style web application checks, with organisation-specific rule overrides and optional deeper scanning. Findings are validated to reduce false positives.

• 0 false positives across 2,740 OWASP Benchmark cases*
• 67% of cross-site scripting detected in a black-box scan*

API Security Scanner

Tests REST APIs using behavioural HTTP probes. Vornin performs endpoint discovery, checks Cross-Origin Resource Sharing (CORS), probes for authentication bypass, and inspects responses for verbose errors, stack traces, and leaked secrets. When you provide an OpenAPI specification, Vornin can run an additional spec-driven API scan.

Cloud Security Posture

Runs 600+ read-only cloud posture checks per provider across Amazon Web Services (AWS), Microsoft Azure and Google Cloud (GCP). Coverage includes CIS Benchmarks and each provider's security baseline. Failed checks enter Vornin's findings workflow.

Static Analysis (SAST)

Static Application Security Testing (SAST) runs 1,000+ security rules across C#, Go, Java, JavaScript, TypeScript, Kotlin, Swift, Objective-C, PHP, Python, Ruby and Scala. Every finding passes an AI false-positive review.

• 95% of OWASP Benchmark vulnerabilities detected*
• 65% fewer misses than Semgrep CE*
• 68% higher OWASP Benchmark score than the average commercial SAST tool in OWASP's published scorecards*

Secret Scanning

Secret scanning checks repositories for hardcoded API keys, tokens, passwords, webhooks, and private keys. Severity reflects the secret type. Add your own ignore patterns so test keys and sample credentials never reach your findings queue. Opt-in live verification confirms whether a leaked key still works, and AI reviews every finding for false positives.

• 100% secret detection rate*
• 2× as many secrets found as TruffleHog*
• 8% higher detection score than gitleaks, 79% higher than detect-secrets*

Dependency Scanning

Software composition analysis (SCA) checks direct and transitive dependencies against several advisory sources, so each vulnerable package appears once. It also reads projects other scanners skip, such as JavaScript without a lockfile and Bun's binary lockfile. Packages your code imports rank higher, and you can export a CycloneDX software bill of materials.

• 100% of 370 known advisories found, with zero false alarms*
• 11% more advisories found than a single scanner*

Infrastructure-as-Code Scanning

Checks Terraform, Kubernetes manifests, Dockerfiles and Docker Compose files in connected repositories for insecure settings before they deploy.

• 91% of misconfigurations found in a 2,996-case labelled test suite*
• 49% more misconfigurations found than Trivy, 15% more than Checkov*

Software Licence Review

Checks open-source package licences in your repositories and flags those that need legal review, such as copyleft, restricted or unknown licences. Vornin does not give legal advice.

Runtime End of Life

Detects Node.js, Python and .NET runtimes that have reached end of community support, from version files, project files and runtime images referenced in Dockerfiles.

Container Image Scan

Container image scanning checks pre-built Docker and Open Container Initiative (OCI) images for operating-system packages, application dependencies, embedded secrets, and image configuration problems.

• Up to 95% less container noise from kernel-header filtering*
• 96.5% of fixable advisories found, level with Trivy and Grype*

Kubernetes Posture

Kubernetes posture scanning checks the configured cluster or a selected namespace for package vulnerabilities, configuration weaknesses, and exposed secrets.

• 67% more seeded misconfigurations found than Kubescape*

Port Scanning

Port scanning uses the Standard profile: the top 1,000 TCP ports with service detection, plus a separate UDP pass where supported. Coverage notices identify unavailable probes and reduced coverage.

• 20% more UDP services identified than nmap*
• 25% more services named correctly than nmap*

SSL / TLS Analysis

SSL/TLS analysis checks certificate validity and expiry, certificate chains, cipher strength, and supported protocol versions. Optional deeper checks cover Heartbleed, ROBOT, insecure renegotiation, CRIME, fallback protection, and HTTP Strict Transport Security.

• Matched Qualys SSL Labs on every check on a live production host, using our own TLS engine*

DNS Security

DNS security scanning validates Domain Name System Security Extensions (DNSSEC), tests attempted zone transfers, and grades email authentication quality rather than checking only whether records exist. It also checks certificate-authority restrictions and mail transport security.

Subdomain Discovery

Combines active DNS enumeration, Certificate Transparency logs, and 45+ passive intelligence sources. Wildcard DNS filtering removes misleading results before discovered assets enter the attack-surface inventory.

Subdomain Takeover

Detects dangling CNAME records that point to unclaimed cloud or software-as-a-service resources. Provider fingerprints are kept current, and known assets are rechecked regularly. Alerts fire when an asset changes into a suspected-takeover state.

WordPress Vulnerability Scan

WordPress vulnerability scanning checks WordPress core, plugins, and themes against known CVEs. The plugin and theme catalogue is kept current from WordPress.org.

Supabase Backend Exposure

Finds client-side apps that expose a Supabase backend: tables readable with the public key, service keys shipped in browser code, and public storage buckets. Read-only probes, no writes.

Known Vulnerability Checks

Checks a target for known CVEs, default credentials, exposed admin panels and product-specific misconfigurations, extending Vornin's built-in checks with technology-specific coverage.