Websitesecurityaudits,backedbyevidence.
Vizyoner is a desktop app that audits the security of websites you own: HTTP security headers, TLS, cookies, CORS, DNS (SPF, DKIM, DMARC) and your project's dependencies — with an AI agent that explains every finding and never invents one.
The Vizyoner desktop app: projects, findings by severity and the AI agent. Sample data shown.
What Vizyoner checks
Values that were actually read — with proof and a fix for every finding.
HTTP security headers
HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP — with nginx, Apache and Node.js fixes.
TLS & certificates
Protocol versions, certificate validity and expiry, the chain and the HTTPS redirect.
Cookies & CORS
Secure, HttpOnly and SameSite flags, plus wildcard and reflected-origin CORS misconfigurations.
Email DNS records
SPF, DKIM, DMARC and CAA records that stop email spoofing and mis-issued certificates.
Dependency vulnerabilities
Exact versions in your lockfiles are checked against the OSV database: CVEs, CVSS severity and the fixed version.
AI security agent
Ask which finding to fix first. The agent answers only from findings that were actually observed.
Why Vizyoner?
No hype — just readable evidence.
Passive and honest
Reads HTTP headers, cookies, TLS, DNS and the DOM surface. Results never claim a proven exploit; every observation is grounded in a value actually read.
Real local tools
In the desktop app, run allowlisted local tools such as Nmap and Python audits — only against targets whose ownership you've verified. Output is shown verbatim.
Evidence-first reports
Each finding carries the affected endpoint, technical proof, a reproduction command and an nginx / Apache / Node.js remediation recipe. Executive summary in one click.
Bilingual, clear
The whole UI, logs and reports switch instantly between English and Turkish. A clean, readable, no-nonsense design.
How it works
Download & install
Download the Windows installer; the app keeps itself updated remotely.
Verify ownership
Prove the target is yours with a DNS TXT record.
Audit & report
Run the passive audit, review the evidence, export the report.
Frequently asked questions
Short, honest answers.
- It passively audits the sites you own: it reads HTTP headers, cookies, TLS, DNS and CORS configuration. It never exploits anything — every observation is grounded in a value actually read.
- No. For active tools and port checks you must prove the target is yours with a DNS TXT record. Unauthorized scanning is outside the app's purpose.
- Real. Every finding carries the affected endpoint, technical proof and a reproduction command. A finding is never fabricated.
- It's a desktop app for Windows 10/11. The audit engine runs locally on your own machine, not on a web service.
- You get 50 free credits when you sign up — enough for your first analyses. Credits are spent on analyses and AI agent questions; packages start at $5 a month.
- Create a project in the Vizyoner desktop app, enter your domain and run an analysis. Vizyoner reads your HTTP response headers — HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy and more — and shows what is missing with a ready-to-paste fix for nginx, Apache and Node.js.
- A passive audit only reads what your site already sends to any visitor — headers, cookies, the TLS certificate and DNS records. It sends no attack payloads, so it is safe to run against production and never claims a vulnerability it did not observe.
- Yes. Point a project at its folder and Vizyoner compares the exact versions in your lockfiles (npm, PyPI, Maven, Composer, Go, RubyGems, NuGet, Cargo) with the public OSV vulnerability database. Your source code is never read or uploaded.
Start auditing your own site.
Set up in minutes. No credit card required.