Find the holes in your website before a hacker does.

Enter the address. Himoya tests the site like an attacker, shows only proven issues and tells you how to fix them in plain words.

Sign upHow it works

Demo site, one recorded scan

Every issue is double-checked before it is reported.

requests sent
908
issues found
8
seconds
19
false alarms
0

What it finds

Nine kinds of holes, explained in plain words

Each issue comes with what it means for your business and what to ask your developer.

  • Text that users submit (a comment, a name) is saved and later shown on the page without being cleaned. A script put there runs for every visitor who sees it.

    Critical/comments

    What to do

    Have your developer clean every comment and name before it is shown.

  • A value from the web address (a search box, for example) is shown on the page without being cleaned. An attacker can craft a link that runs their script in a visitor's browser.

    High/search

    What to do

    Have your developer clean anything taken from the address before it is shown.

  • A password, token or cloud key appears in a page or response the site sends out.

    High/

    What to do

    Replace the key right away, then keep keys out of pages and code.

  • A page meant for administrators answers to an ordinary user as well.

    High/admin

    What to do

    Check the user’s role on every admin page, not only in the menu.

  • Records are reached by a number in the address (for example /orders/1). Changing the number shows a record that belongs to someone else.

    High/orders/1

    What to do

    Have your developer check, on every request, that the record belongs to the person asking.

  • A value from the page is passed straight to the server's operating system as a command.

    Critical/ping?host=

    What to do

    Never pass a page value to the server as a command; use fixed, safe calls.

  • A file name from the page is used without checking, so ../ in it reaches files outside the intended folder.

    High/files?name=../

    What to do

    Accept only known file names and refuse anything with ../ in it.

  • The server does not send a protective header (such as HTTPS enforcement or content rules) that browsers rely on.

    Medium/

    What to do

    Switch on the missing header in the server settings.

  • An address that should not be public (such as /.env, a backup or a debug page) answers to anyone.

    Critical/.env

    What to do

    Remove the file from the public folder and close the address.

How it works

Three steps. No security team needed.

  1. 1

    Enter the address

    Add your website's address. Himoya only tests sites you own or have permission to test.

  2. 2

    Himoya tests it

    AI agents try what an attacker would try. No harm to the live site: they only read, and nothing is created, changed or deleted.

  3. 3

    Issues and how to fix them

    For each issue: how serious it is, what could happen and what to do. Your developer gets the technical details too.

Why you can trust Himoya

  • Only your own site

    Himoya tests only the site you added. Any request that would leave your site is blocked.

  • No harm to the live site

    Read-only mode is on by default: nothing on your site is created, changed or deleted.

  • Every issue double-checked

    Before an issue reaches you, Himoya tries it again three times with fresh logins. If it does not happen again, you never see it.

Double-check log
High

One user can open another user's data

/orders/1

  1. Try 1happened again182 ms
  2. Try 2happened again176 ms
  3. Try 3happened again191 ms
  4. Check as the real ownerworks as expected
Confidence96%

Confirmed. Reported as High.

Who it is for

  • Business owners

    A plain report: what is wrong, how serious it is and what to ask your developer. No security jargon.

  • Developers

    Technical details for every issue: the request, the proof and a code example of the fix.

    • Node.js
    • Python
    • PHP
    • NGINX
    • Java
    • Kotlin
    • Swift
    • Flutter
  • Coming soon

    Teams

    Run Himoya from a GitHub Action and get new issues in Slack or Telegram.

    • GitHub
    • GitLab
    • Slack
    • Telegram

Sign up for Himoya

We are opening Himoya to a small first group.

  • We set up your first scan together with you
  • An early-access price
  • You try new features first
Sign up

Already have access? Sign in

Questions

hello@himoya.ai
Can Himoya break my site?

No. On a live site it only reads: it does not send forms, save data or delete anything. Tests that need to write run only on a test copy of your site.

Do I need to be technical?

No. Each issue is explained in plain words: what it means, what could happen and what to ask your developer. The technical details sit apart, for whoever fixes it.

How do you avoid false alarms?

Every suspected issue is tried again before it is reported. If it does not happen again, it never reaches your list.

Which sites can I scan?

Only sites you own or have permission to test. Requests that would leave your site are blocked.

What does “Himoya” mean?

It is Uzbek for “protection”. That is the job.