Start free.
Scale when you need it.

Yes. On Dev, Team, and Pro plans you can pass authentication headers (Bearer token, API key, Basic auth) so we can scan private or protected endpoints.

Dozens of checks across six areas: security (headers, CORS, injection probes, exposed files, cookie flags), performance (compression, caching, latency), API design, documentation, error handling, and standards. The full list is in the docs.

All checks run in parallel, so most scans finish fast. The Intelligence deep-scan adds an extra passive recon layer on top of the standard scan and takes a bit longer.

You can scan any public API. Just respect the rate limits and terms of service of whatever you're scanning. We have built-in throttling so we don't hammer the target.

Response bodies are processed in memory and never stored. We only keep the score and the findings.

Yes. `npx cyberian scan <url>` works without an account for basic checks. You need to log in to see the full report and your scan history.