Onscanner
Which OWASP Top 10 risks can an automated scanner reliably detect, and which need manual testing? A category-by-category detectability guide.
Estimated origin: United States
StackScope is a free public catalogue of indie launches. We find launches on Product Hunt, Hacker News and similar feeds, then crawl each site to detect its tech stack and score it for launch readiness: DNS, security headers, SEO basics. This page is what we saw on 9 July 2026; the live site may have changed since.
Onscanner scores highly overall, with complete legal pages, a complete set of security headers, and a thorough launch checklist. Visible gaps: tracking cookies set before any opt-in.
Launched on Hacker News on July 9, 2026. The site is served through Cloudflare, with a domain registered in 2025. We've detected 13 technologies on this site, covering analytics, captcha, CDN, and CSS frameworks. The stack includes Tailwind CSS, Cloudflare, and Cloudflare DNS.
It's on one of the most common stacks we track, shared by 5,603 launches and more locked down than the typical Hacker News launch.
If you own this site, refresh the snapshot and see the full fix list any time →
Tech Stack (13)
| CDN |
Cloudflare
|
| DNS |
Cloudflare DNS
|
| Security | HSTS |
| Business email |
Zoho Mail
(2)
|
| Captcha |
Cloudflare Turnstile
|
| CSS framework |
Tailwind CSS
|
| Analytics |
Cloudflare Web Analytics
|
Google Analytics
(5)
|
|
| SEO |
Google Search Console
|
| Social |
Google Search
|
| Tag management |
Google Tag Manager
(2)
|
| Payments |
Stripe
|
| SaaS |
Zoho
|
Infrastructure
Email Security
Storage (2)
| Name | Lifetime | Detected as |
|---|---|---|
| _ga | 1y | Google Analytics |
| _ga_5WCLKM01G0 | 1y | Google Analytics |
Readiness Breakdown How?
Performance How?
Indicative grade from a single automated render, not a substitute for Lighthouse or field data, and not part of the StackScope score.
Vibe Score Breakdown How?
| Signal | Points |
|---|---|
| AI copy signals | +5 |
| AI palette signals | +3 |
This score is based on structural patterns and is not definitive. Many legitimate sites may trigger signals, and AI-built sites may go undetected. It should be treated as an indicator, not a verdict.