Security Scanner · zAiBreach

🔍 Security Scan

Select Scan Types:

Target URL or Domain

Scan as a signed-in user Supply a session credential so the assessment can reach pages behind the login.

ℹ️ Paste a credential you already hold. Sign in to the target yourself, then copy the session cookie from your browser's developer tools, or paste an API bearer token. A credential you do not save is sent with this one assessment, used in memory, and never written anywhere.

🔒 A test user you save is encrypted on the server and visible only to this account. It is never stored in this browser. Give it a label and it is reusable for this domain; remove it with the × and it is gone.

Sign-in identities admin + regular

Add one per role — e.g. an administrator and a regular user. We sign in as each and compare what they can reach, so broken access control and privilege-escalation show up. Passwords are encrypted on the server and never kept in this browser.

Login form details — only if sign-in doesn't take

Login page path Where the login form lives, relative to the target. Defaults to the target itself.

Username field name

Password field name

Session cookie or paste one The whole Cookie header, exactly as the browser sends it. Use this instead of username/password if you already have a session.

Bearer token optional Sent as Authorization: Bearer …. Use this instead of, or as well as, a cookie.

Extra headers optional A JSON object. Added to every authenticated request.

Paths to try optional One path per line. Each is requested signed-in and signed-out, and the two answers compared.

Multiple identities and authorization tests

These take the JSON the API documents. Leave them empty for a single-identity assessment. See the API reference for the shape of each.

Role profiles

IDOR tests

Privilege paths

🐙 GitHub Code Security

Scan your repository for secrets, vulnerable dependencies, and code vulnerabilities.

GitHub Repository URL

Branch

Personal Access Token (private repos)

☁️ Cloud Exposure Scanner

Detect public S3 buckets, exposed databases, and cloud misconfigurations.

Domain or Company Name

🔑 Secrets Detection

Find exposed .env files, API keys in JavaScript, and sensitive data leaks.

Target URL

🎯 Targets

zAiBreach only assesses domains you have proved you control. Verify a domain once; every assessment against it and its subdomains is then authorised.

Add a domain

Loading your domains…

📜 Scan History

Target	Time	Status	Score	Grade	Actions
No scans yet. Start your first scan!

🔍 Security Scan

🐙 GitHub Code Security

☁️ Cloud Exposure Scanner

🔑 Secrets Detection

🎯 Targets

📜 Scan History

📊 Results:

🔐 Login

🔑 Reset password

🛡️ Authorization needed

📝 Create account