YANSII Free — Passive Security Scanner

Passive web security scanner: header/cookie/CORS audit, XSS & injection indicators, crawler, dashboard. Authorized testing only.

YANSII is a passive security testing tool for web applications. It runs entirely in your browser and helps security researchers and developers identify potential issues during authorized testing. FEATURES: - 46 passive vulnerability scanners that run as you browse - Three-tier findings model: directly-observable facts (missing security headers, cookie flags, CORS misconfigurations) shown separately from potential indicators that need manual verification - Security header and cookie auditing - Dashboard with domain grouping, severity filtering, and search - Side panel and DevTools panel for reviewing findings - Built-in crawler - Export findings as JSON or Markdown - Scope enforcement and noise filtering PRIVACY: All scanning runs locally in your browser. No account required. No data is sent to any server. Your findings stay on your device. HONEST BY DESIGN: YANSII distinguishes what it can directly observe from what it can only suggest as a lead — it does not claim confirmed vulnerabilities it cannot verify. Open source (BSL 1.1). A Pro version with AI-assisted analysis is available separately. IMPORTANT: Use this tool only on applications you own or have explicit authorization to test. Unauthorized security testing may violate computer fraud laws.