Ostorlab Free Scans Now Cover Websites, Source Code and App Vetting
Ostorlab offers free security scans for mobile apps, websites and source code, with the report emailed to you. Security teams can also vet third-party mobile apps for free with a free Ostorlab account.
Ostorlab Free Scans Now Cover Websites, Source Code and App Vetting
Quick answer: Ostorlab offers free security scans for mobile apps, websites and source code, with the report emailed to you. Security teams can also vet third-party mobile apps for free with a free Ostorlab account.
Until now, the free scan covered mobile apps only. You picked an app from Google Play or the App Store, and we emailed you a report. Teams used it as a first check before a release or an audit, and asked for the same thing for the rest of their stack.
What you can scan for free
| Free scan | What you give it | What it tests | Start |
|---|---|---|---|
| Mobile app | An app from Google Play, the App Store or Huawei AppGallery | Static analysis of the public store build | Scan a mobile app |
| Website | A URL you own or are authorized to test | Passive crawl, TLS, security headers, known-vulnerable components | Scan a website |
| Source code | A .zip, or a repository from GitHub, GitLab, Bitbucket, Azure DevOps or self-hosted Git | The code, its dependencies and hardcoded secrets | Scan your code |
| App vetting | A third-party Android, iOS or HarmonyOS app from a public store | The app's 0–100 risk score | Create a free account |
Mobile apps. Pick an Android, iOS or HarmonyOS app from Google Play, the App Store or Huawei AppGallery. We run static analysis on the public store build: insecure storage, weak cryptography, hardcoded secrets, risky permissions and vulnerable libraries.
Websites. Enter a URL you own or are authorized to test. The free web scan crawls the site passively and checks TLS, security headers and known-vulnerable components. It sends no attack payloads and doesn't submit forms, so it's safe to run against production.
Source code. Upload a .zip, or connect a repository from GitHub, GitLab, Bitbucket, Azure DevOps or self-hosted Git. We analyze the code, its dependencies and any hardcoded secrets such as API keys and tokens. Nothing is built or executed.
App vetting. Security teams can check a third-party mobile app before allowing it on company devices. With a free Ostorlab account, request vetting for any Android, iOS or HarmonyOS app from a public store and get its 0–100 risk score when the scan is done. The full report behind the score comes with a paid plan. The Definitive Guide to Mobile App Vetting.
How it works
App vetting runs in the Ostorlab platform: create a free account, search for the app, and the score shows when the scan is done. The other three scans need only your email:
- Go to ostorlab.co and pick Mobile app, Web & API or Source code.
- Enter the app, the URL or the code, and your email.
- Free scans are queued. When the scan finishes, the report lands in your inbox.
What the free scans don't cover
The free scans look at what's visible from the outside, or in the code. They don't log in, run the app or attack your APIs. That's where most serious issues live: broken authorization, business logic flaws, and attack chains that only show up at runtime.
For those, Agentic Deep Scan explores your app the way an attacker would. With test setup, it handles logged-in flows, including 2FA and SSO, and proves each finding with evidence you can reproduce. See the difference in the mobile and web sample reports.
FAQ
Is the Ostorlab free scan really free? Yes. No credit card or sales call is needed. For mobile, web and source code scans you only enter your email, and the report is sent there. App vetting needs a free Ostorlab account.
Is the free web scan safe on a production site? Yes. It crawls passively and checks TLS, headers and known-vulnerable components. It submits no forms and sends no attack payloads.
Does the free source code scan run my code? No. It's static analysis of the code, dependencies and secrets. Nothing is built or executed.
Is mobile app vetting free with Ostorlab? Yes. Create a free Ostorlab account and request vetting for a store app. You get its 0–100 score when the scan is done. The full report behind the score comes with a paid plan.
What's the difference between the free scan and Agentic Deep Scan? The free scan is static or passive. Agentic Deep Scan logs in, runs the app, tests the APIs, and proves findings with reproducible evidence.