qsa.sh Logo

About qsa.sh

qsa.sh is a tool that performs an external port and vulnerability scan of your own public IP address, executed directly from your terminal with a single curl command. It uses open-source industry-standard tools, naabu for port discovery, nmap with the vulners script for service and CVE fingerprinting, and nuclei for exposure checks, all running from remote scanner nodes to give you an outside-in view of your host's internet-facing security posture. Scans are streamed live to your terminal, results are ephemeral (never stored), and the process is transparent: you see exactly what tools are run and can inspect the output in real time. The product is designed with strict safety constraints: it only scans the IP address from which the request originates, and it refuses to scan known CGNAT, mobile-carrier, proxy, VPN, or Tor addresses, as well as IPv6 origins. Each scan begins with a 15-second warning window during which you can abort, serving as a consent gate. Three tiers are available: a free tier scanning the top 1,000 TCP ports with a curated set of nuclei checks, a Full subscription requiring a paid plan covering all 65,535 ports with async delivery, and a Deep one-time scan for a set fee that runs the full nuclei template set and emails the report. Paid access uses one-time tokens without requiring an account.