Prove you control a domain, then check whether its PHP is out of date and unpatched.
A local or allowlisted target can’t be verified via DNS/file. On a dev deployment
(SSRF_ALLOW_HOSTS set) you can mint a grant directly, or paste one you minted on the CLI.
The deep probe sends real read-only GET requests to known paths (.env, .git,
phpinfo) on your verified site — no exploit payloads. It runs only when you click it.
A single, read-only PHP file that reads the exact PHP version, risky php.ini settings and your
composer.lock dependencies — things a remote scan can’t see. Read it before running it; it writes nothing.
A one-off check tells you where you stand today. We’re considering building something that keeps watch for you — and emails you, in plain language, only when something genuinely new needs your attention. Less noise, fewer nasty surprises.
If enough people want it, we’ll build it — as a paid subscription. Join the waitlist to help shape it and lock in early-bird pricing.
We store only your email (and site, if given), in the EU, on the basis of your consent — never shared, never used for anything else. Unsubscribe or ask us to delete your details any time: privacy@senbonai.se.