Helmet
A security inspection for sites you own or are authorized to test. Enter a target, run the scan, read the report.
Three steps, no surprises.
You confirm you're authorized before each scan. Only scan targets you own or have explicit written permission to test — you're responsible for every scan; Helmet and Republic of Zani are not responsible for unauthorized use.
Step 1
Confirm authorization
Tick the box to confirm you own the target or have explicit written permission to test it. Only scan authorized targets.
Step 2
Run the scan
Helmet inspects the live site — headers, software versions, injection points, exposed files — at a polite, rate-limited pace.
Step 3
Read the report
Get an HTML report listing what it found, how serious it is, and what to change. Share it or hand it to a developer.
A full field inspection.
Every scan runs hundreds of checks grouped into the areas that actually get sites compromised.
Security headers & TLS
Missing HSTS, CSP, cookie flags, weak TLS config.
Known-vulnerable software
Outdated frameworks matched to CVEs and the CISA KEV catalog.
Injection flaws
SQL injection, cross-site scripting, template injection.
Exposed files & misconfig
Leaked .env, backups, build manifests, debug endpoints.
Subdomain takeover
Dangling DNS pointing at unclaimed services.
Auth & session issues
Weak session handling, access-control gaps, IDOR patterns.
Pay for scans, not seats.
Start free. Upgrade when you want to scan more often — pay by bank transfer, no card needed.
Helmet
€30/mo
For a site you maintain
✓30 scans a month
✓Full reports
✓Re-scan after fixes
Your inspection console.
Create a free account and run a scan right here. Nothing to install.
Sign in to Helmet
Sign in or create a free account.
