Skip to content

Security scanner for apps you own

Every app has a weak point.

Achilles is a security scanner for web apps you own. It runs real tools against your site, shows you what they found, and writes fixes you can paste into your AI coding tool.

You'll verify ownership before anything is scanned.

Illustrative sample data, no real app is scanned.
SAMPLE6FINDINGS
THE SHIELD OF ACHILLESEvery emblem is a check. The arrow marks the one that failed.

The pantheon

Every check has a patron.

Each scanner runs under the banner of the god who knows that ground best.

  • Hestia

    Prove it's your hearth

    Publish a token at /.well-known/achilles.txt or in a DNS TXT record. Nothing is scanned until ownership checks out.

    ownership check · Arjun

  • Hermes

    Fingerprint the stack

    The messenger asks your server who it is and reports the framework, server and versions it gives away.

    httpx

  • Poseidon

    Chart the open ports

    Maps which ports answer from the internet, so a dev server left open doesn't stay hidden.

    Nmap

  • Artemis

    Hunt known weaknesses

    Tracks exposed files and risky configuration with targeted templates, and JavaScript libraries with known vulnerabilities.

    Nuclei · Retire.js

  • Hephaestus

    Test the armor

    Checks the TLS your app wears for weak protocols and ciphers.

    testssl.sh

  • Hera

    Watch the headers

    Looks for missing security headers and permissive CORS.

    header checker

  • Hades

    Unearth buried secrets

    Searches your JavaScript for keys and tokens that should have stayed underground.

    TruffleHog · JS checker

  • Athena

    Counsel for the fix

    Turns each finding into a plain-English explanation and a fix prompt for Cursor, v0, Lovable or Bolt.

    AI remediation

Four steps. One clearer path.

Your Odyssey to a more secure app

  1. Step 1: Establish Ownership

    Prove you control the app with a file at /.well-known/achilles.txt or a DNS TXT record.

  2. Step 2: Chart the Surface

    httpx fingerprints your stack and Nmap maps which ports answer from the internet.

  3. Step 3: Uncover Weaknesses

    Nuclei, testssl.sh, TruffleHog, Retire.js and a JS/header checker look for exposed files, secrets, weak TLS, vulnerable libraries and risky config.

  4. Step 4: Navigate to a Fix

    Each finding gets evidence, an explanation and a fix prompt. Rescan to confirm the issue is gone.

Find the heel before the arrow does.

Verify your app, run the scan, and leave with fixes you can paste into your AI builder.