Cycling through all six. Tap any point to stop.

Measured on six things

Instant external security scan of your own IP via curl co...

Growth

Brand-new Product Hunt launch with modest ~100 upvotes. No reviews, no GitHub, no community presence yet. Early trajectory only.

Screenshots

1 / 1

qsa.sh

About this app

qsa.sh is a refreshingly simple security tool that lets you run a full external port and vulnerability scan on your own public IP with a single curl command. No installation, no agents, no account required. Under the hood, it chains together naabu, nmap with vulners, and nuclei to check for open ports, service versions, TLS posture, and known CVEs—all streamed live to your terminal in about 30 seconds. The Free tier covers the top 1,000 ports and ~2,000 nuclei templates; Full ($5/mo) expands to all 65,535 ports; Deep ($7 one-time) runs the entire nuclei template set (~10,500) for a thorough 13–16 minute scan with a full emailed report. I love how it gives you an outside-in perspective of your own host without any setup hassle. Just run curl qsa.sh or curl https://qsa.sh (encrypted) and watch the results pour in. It's perfect for quick security assessments, but remember—you can only scan your own IP, and known CGNAT, carrier, proxy, VPN, and Tor addresses are blocked. The ephemeral n...

Key features

1One-command external scan via curl with live terminal streaming
2Three tiers: Free (~30s, top 1k ports), Full ($5/mo, all ports), Deep ($7 one-time, full nuclei + report)
3Zero storage, explicit consent window, scans only the connecting IP

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

Sysadmins and DevOps engineers

Pain points

Need quick, agentless external vulnerability checks on personal or lab IPs

Primary needs

Instant scan, no install, live terminal output

Demographic

Security researchers and penetration testers

Pain points

Want to verify tool output or get a fast outside-in perspective on own IP

Primary needs

Comprehensive CVE checks, multiple scan depths, no stored results

Demographic

Freelancers and small business IT managers

Pain points

Limited budget for security tools, need a free or low-cost scan option

Primary needs

Cost-effective, easy to use, immediate actionable findings

Scout Review

Written by AI from measured evidence, scored out of 100.

qsa.sh delivers exactly what it promises: a zero-friction external scan of your own public IP using well-known open-source tools. The experience is fast, transparent, and refreshingly free of accounts or installs. Limitations around target scope and carrier networks are honest and well documented. The product is still extremely young, so polish and community signals remain light.

Measure by measure

Usability

One-command external scan with zero setup. Clear consent gate and tier comparison table. Limited to own IP only and blocks common CGNAT/carrier ranges.

Design

Clean terminal-first aesthetic with strong code-block focus and consistent dark theme. Hero feels cramped and navigation is generic with low-contrast elements.

Speed

Perfect Lighthouse 100/100 on both mobile and desktop. Minimal assets and fast LCP keep the landing page snappy.

Security

Strong header hygiene (CSP, secure cookies, frame protection) but missing HSTS and email auth records. No third-party compliance attestations published.

Accessibility

Automated score 100/100 with one minor label mismatch. Responsive dark theme works well; no dedicated accessibility statement or language options.

Growth

Brand-new Product Hunt launch with modest ~100 upvotes. No reviews, no GitHub, no community presence yet. Early trajectory only.

Improvement areas

Missing HSTS, SPF, DMARC and any third-party security attestations
Hero section feels cramped; navigation lacks visual polish
Extremely early stage with minimal reviews or community signals

Design & Usability

qsa.sh leans hard into terminal minimalism. The hero puts the curl command front and center, which matches the product's entire value prop. Navigation is functional but unremarkable, and the body text below the fold gets dense quickly. On the usability side, the one-command experience is genuinely delightful—no accounts, no agents, instant feedback. The hard limits (own IP only, CGNAT blocks, 15-second consent window) are clearly communicated and feel like deliberate safety choices rather than afterthoughts. Pricing comparison on its own page removes guesswork.

Speed & Security

Performance is excellent; Lighthouse hands it perfect scores on both mobile and desktop thanks to tiny assets and a static-first approach. Security headers are mostly solid (CSP, secure cookies, proper referrer policy) but the absence of HSTS and SPF/DMARC keeps it from feeling enterprise-grade. No public audits or bug-bounty program appear on the site or in search results, which is typical for a solo or tiny-team side project at this stage.

Accessibility & Growth

Accessibility scores top marks in automated testing with only one minor label issue. The dark theme maintains good contrast and the layout is responsive. Growth is the weakest dimension: the product launched on Product Hunt in the last week of July 2026 and has collected roughly 100 upvotes with almost no other footprint—no GitHub repo, no independent reviews, and only a couple of Reddit launch posts. At this age that is normal, but it also means the traction story is still just beginning.

Conclusion

If you need a quick outside-in check on a VPS or lab box you control, qsa.sh is worth a curl right now. Just remember it only ever scans the IP you connect from.

Suggestions for improvement

Add a visible security or compliance page even if it just lists current header posture and future plans
Publish the GitHub repo for the open-source components or at least a changelog
Improve hero spacing and give the navigation bar clearer active states or hover feedback
Consider a lightweight status or uptime page to build trust for paid tiers

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	qsa.sh	Nmap	Shodan	Nuclei
Installation required	None (curl only)	Local install required	None (web service)	Local install required
Target scope	Own public IP only	Any IP (with permission)	Any indexed device	Any target (local run)
Live terminal output	Yes, streamed	Yes, local CLI	No (web dashboard)	Yes, local CLI
Pricing model	Free tier + $5/mo or $7 one-time	Free / open source	Free tier + paid plans	Free / open source