# Sumrite Free Security Scan (scan.sumrite.com)

> Free online vulnerability scanner from Sumrite for websites and Android and iOS apps. Enter a website, or upload an Android .apk or iOS .ipa build, and get a clear, risk-rated security report in about five minutes, on screen, as a PDF and by email. No credit card and no sales call. Sumrite (sumrite.com) is a managed cybersecurity and compliance firm, founded in 2007 and based in New Delhi, India, that delivers expert-led penetration testing (VAPT) for clients worldwide.

## What the website scan checks

- Security headers: Content Security Policy, HSTS, X-Frame-Options, Referrer-Policy and cookie flags
- SSL/TLS: certificate validity and expiry, protocol versions and weak encryption
- Open ports and exposed services, such as databases or admin panels reachable from the internet
- Subdomain discovery from certificate transparency logs, including forgotten and test hosts
- DNS security: zone transfer (AXFR), DNSSEC, open recursion, dangling CNAMEs (subdomain takeover risk), SPF and DMARC
- Exposed API surface: OpenAPI and Swagger documentation, GraphQL endpoints and security.txt
- Passive web application checks built on OWASP ZAP for common OWASP Top 10 weaknesses
- Internet exposure and technology fingerprinting from public OSINT sources such as Shodan

The website scan is passive and safe for live systems: it sends no exploit payloads and does not try to break in.

## What the mobile app scan checks

- Static analysis of Android .apk and iOS .ipa builds, with no device or source code needed
- Dangerous permissions and exported components
- Hard-coded API keys, tokens and credentials
- Insecure network settings such as cleartext traffic and weak certificate validation
- Weak cryptography and unprotected on-device data storage
- A security score and attack-surface summary

## How it works

1. Enter a website address, or upload an Android .apk or iOS .ipa build.
2. Confirm ownership with a work email on the same domain as the website.
3. Get the report in about five minutes, with risk ratings and a fix for each finding.

## Free scan vs penetration test

Automated checks find common, visible issues. A penetration test is led by a security expert who abuses business logic, access control and chained weaknesses that no tool finds. For SOC 2, ISO 27001, PCI DSS, PDPL and DPDP evidence, Sumrite's expert-led VAPT provides a verified report, and Sumrite runs the whole compliance engagement with its partner audit firms.

## Links

- [Free security scan](https://scan.sumrite.com/): run a free website or mobile app vulnerability scan
- [Sumrite](https://sumrite.com/): expert-led penetration testing and VAPT
- [Web application VAPT](https://sumrite.com/services/web-application-vapt)
- [Mobile app VAPT](https://sumrite.com/services/mobile-app-vapt)
- [API security testing](https://sumrite.com/services/api-security-testing)
- [Network VAPT](https://sumrite.com/services/network-vapt)
- [Continuous penetration testing (PTaaS)](https://sumrite.com/services/continuous-penetration-testing)
- [Sample VAPT report](https://sumrite.com/resources/sample-vapt-report)
- [Free DPDP personal data discovery tool](https://dpdp.sumrite.com/)
- [Contact Sumrite](https://sumrite.com/contact)
- [Sumrite llms.txt](https://sumrite.com/llms.txt)