FAQ

Do I need an account?#

Can I scan a different server?#

Not from another machine. The scan always targets the IP you connect from. To scan a specific server, run the command on that server.

What does the scan actually run?#

naabu 2.6.1 for ports, nmap 7.93 with the vulners script for service versions and CVE matching, and nuclei 3.3.9 with the public templates. See The scan pipeline.

How is this different from an agent based scanner?#

An agent reports what is configured on the host. qsa.sh reports what is reachable from outside without credentials. The two lists differ more often than people expect.

How often can I scan?#

Free is once per IP per 24 hours. Full Pro is once per hour. Deep is unlimited. See Scan tiers.

Is my scan result stored?#

Free scans store nothing beyond a short lived rate limit counter. Paid results live in a single read or 24 hour Redis window so you can collect them, with no database. See Data retention.

Why was my scan refused?#

The connecting IP was CGNAT, a mobile carrier range, IPv6, or flagged as proxy, VPN or Tor. See Troubleshooting.

Why does the site say to use HTTPS?#

curl qsa.sh connects over plain HTTP. curl https://qsa.sh encrypts the scan and its results in transit.