Owner-verified · Non-invasive
Know your domain's weak points before attackers do.
Bastion audits the sites you own for misconfigurations, outdated software and actively exploited vulnerabilities — without exploits, password guessing or heavy scanning.
- 40+
- checks per audit
- CVE
- + actively exploited
- 0
- intrusive requests
Capabilities
Everything an outsider can see — reviewed for you.
Ownership first
Every domain is verified with a DNS record or file before a single check runs. No one can audit a site they don't control.
Transport & headers
HTTPS, redirects, HSTS, content security policy, clickjacking and cookie flags — each with a copy-ready fix.
Known vulnerabilities
Detected software versions are matched against the national vulnerability database, with actively exploited flaws flagged first.
Zero-day exposure
End-of-life software, leaked version banners and risky stacks are surfaced — the conditions where new zero-days hurt most.
Dr. Z risk analysis
An AI security advisor turns raw findings into a prioritised plan and explains how to limit damage from unknown flaws.
Report history
Every audit is saved so you can track your score over time and prove progress to your team.
Add your domain
Request access, get approved, then enter a domain you manage.
Prove ownership
Add a one-line DNS record or file. Bastion re-checks it on every audit.
Audit & fix
Get a scored report, Dr. Z's risk analysis and step-by-step fixes.
An honest word about zero-days
By definition, a zero-day is a flaw nobody has published yet — no outside scanner can confirm one. Bastion does the next best thing: it finds the outdated, unsupported and over-exposed software where zero-days strike hardest, and Dr. Z explains how to contain the damage. Public checks also complement, but never replace, a review of your backend access controls and database policies.