Topscan.me consolidates three security vendors into one deadline-driven platform
A new platform called Topscan.me targets companies where security is a part-time responsibility, usually handled by a CTO or DevOps lead. It combines code analysis, web application scanning, and external perimeter monitoring in a single workspace where every finding carries a fixed remediation deadline. The product launched with a transparent pricing model and a discovery-first approach that avoids unauthorized port scans.
Three scanning surfaces in one workspace
Most small teams buy separate tools for static code analysis, dynamic application scanning, and external attack surface management. Topscan.me covers all three. For code, it connects to GitHub or GitLab (including self-managed instances) with a read-only token. It scans for risky patterns, exposed secrets, and vulnerable dependencies. The repository clone is deleted when the scan finishes; only the finding and a snippet of the affected lines remain.
For running web applications, it performs external scanning with an optional deep mode that crawls the application and runs active OWASP Top 10 tests. For the external perimeter, it enumerates open ports, service versions, known vulnerabilities, and certificates. It detects new hosts that appear where none existed before and rescans on a schedule. AWS discovery pulls EC2 and Route 53 resources through keys the customer issues. Nothing is installed on the customer's servers.
Discovery before scanning, with legal guardrails
Adding a domain triggers a discovery phase: Certificate Transparency logs, DNS enumeration, and a single ordinary HTTP request per host—the same request a browser sends. No ports are touched. Within five to ten minutes the result is a map of what faces the internet. No further scanning runs until the user confirms a target. Port scans and active checks are limited to confirmed hosts. The documentation states the reason directly: in some jurisdictions an unauthorized port scan is a criminal matter. Hosts discovered and then dismissed are never scanned and consume no license.
One finding per vulnerability, status tracked per host
The same vulnerability on five hosts appears as one entry in the issue list, so the list stays as long as the problem exists. Status, however, is kept per host and port. Marking a finding as a false positive on one host leaves the other four with their deadlines intact. Many tools store status on the vulnerability itself, where one click can quietly hide a real problem on forty other machines. Topscan keys status to target, issue type, port, and protocol. A triage mode expands any grouped entry into its individual occurrences.
Security Score based on deadlines, not finding counts
Every finding receives a deadline from the day it was first detected: seven days for critical, thirty for high, sixty for medium, ninety for low. The Security Score starts at 100 and loses points only when a finding passes its deadline. A workspace that scans more and finds more does not score worse for having looked. Snoozing pauses the clock and resumes it where it stopped. A deferred fix stays visible. A separate, cumulative SLA compliance rate covers the entire history of the workspace for auditors.
Evidence attached to every finding
Each finding carries what produced it: hostname, status code, response banner or certificate date, and the time of the check. This allows verification in seconds without trusting the label. The engines are open source and named: naabu for ports, OpenVAS for infrastructure vulnerabilities, Nuclei for web checks, and OWASP ZAP for the deep stage. The project positions the engine as a commodity; the inventory, deadlines, evidence, and history are the product.
Pricing without a sales call
Two plans are offered at $129 and $269 per month, with a 14-day trial of the full plan that requires no credit card. Per-target add-on rates are the same on every plan: $4 per infrastructure host, $45 per web application, $9 per repository. Users are unlimited. Scans are never billed. Read-only seats for auditors are free. AWS discovery and Slack and Jira routing are included on the higher plan.
Getting started
Discovery produces the first perimeter map within five to ten minutes of starting the trial, before anything is scanned. The platform is built for teams that need continuous visibility without managing multiple vendors or negotiating enterprise contracts.