2MNY Website Vulnerability Scanner Is Now Open Source — v1.0.0 on GitHub

Today we are doing something we have wanted to do for a long time: the core of 2MNY — our website vulnerability scanning engine — is now open source on GitHub under the Apache-2.0 license. Free to download, free to self-host, free to modify, free to build a business on.

The repo: github.com/RanaKhan77/Website-Vulnerability-Scanner

If you run websites for a living — an agency, a hosting company, a security team, or your own projects — you can now point our entire scanning arsenal at your own domains from your own server. No account with us required, no per-scan billing, no AI vendor reading your targets' pages.

What is in the Community Edition

The Community Edition (CE) ships with 200 deterministic scanner modules out of the box, organized into 14 categories: OWASP-class web vulnerabilities, reconnaissance and attack-surface mapping, DNS and email security (SPF/DKIM/DMARC), security headers, HTTP protocol hygiene, SSL/TLS configuration, technology fingerprinting, CMS and framework stacks, exposed panels and cloud services, and — the part we are proudest of — AI/LLM surface detection, which fingerprints exposed LLM gateways, agent panels, vector databases and model-serving ports on the sites you scan.

The engine is deliberately boring in the best way:

• Deterministic, not AI-mediated. Same target, same findings, every run. Every finding carries evidence you can defend to a CISO or in court — we do not ship "the model said so."
• Zero AI at scan time. No API keys to rotate, no token billing that scales with your workload, no sending your targets' pages to a third-party vendor.
• Full Docker stack. App, worker, scheduler, nginx, MySQL and Redis — docker compose up and you are scanning.
• Evidence-backed reporting. HTML and PDF reports, with internal (technical) and customer (redacted) variants — the same report engine our managed service uses.
• Continuous monitoring. Page watches, attack-surface diffing and scheduled rescans, not just one-shot scans.

You can browse the complete module list in the tool matrix, and see every category live on our features page.

Quick start (about 10 minutes)

git clone https://github.com/RanaKhan77/Website-Vulnerability-Scanner.git
cd Website-Vulnerability-Scanner/docker
cp .env.example .env        # edit: set DB_PASSWORD etc.
docker compose up -d
docker compose exec app php artisan migrate --force

Then open the dashboard, create your admin account, add a website, and start your first scan. The repo includes a full INSTALL.md with troubleshooting, and our v1.0.0 release notes cover what shipped in this version.

One rule: scan only what you own or have written permission to test. Several intrusive modules are ownership-gated on purpose — deep tests only run against sites you can prove you control.

Why we open-sourced it

We have been scanning at national scale for a while now — more than 29,000 domains under continuous monitoring through our managed platform at 2mny.com. That taught us two things.

First: the biggest security gaps on the web are not exotic zero-days. They are missing headers, expired certificates, forgotten admin panels, unmaintained WordPress plugins and leaked secrets — things a deterministic scanner finds reliably, every single day. You do not need a large language model to catch a five-year-old version of jQuery being served on a login page; you need discipline.

Second: trust. "Trust our scanner" is a weak argument when the scanner is a black box. When the entire detection logic is public — every module, every check, every false-positive guard — you can audit exactly what we do and what we do not do. Open source is not a marketing gesture for a security product; it is the correct default.

What is NOT in the Community Edition

To be transparent about the boundary: our commercial product at 2mny.com keeps some things to itself — additional scanner modules, our managed multi-tenant infrastructure, priority support and the full source-code licensing program for teams that want the complete 235+ module platform to run as their own product. The CE is not a crippled trial; it is a genuinely complete scanner that will stay useful forever. But if you want everything we have, the commercial side is there.

There is also a free community license track with perks for contributors — meaningful PRs (new scanner modules, better false-positive guards) can earn managed-service credits.

What happens next

• Star the repo if this is useful to you — github.com/RanaKhan77/Website-Vulnerability-Scanner. It genuinely helps other people find it.
• Read issues before opening one — and send security findings privately to the contact in the repo's SECURITY.md, never as public issues.
• Contribute — new deterministic scanner modules and false-positive-guard improvements are exactly what we hoped the community would bring. The CONTRIBUTING.md in the repo has the bar we hold ourselves to.

We will keep maintaining the CE in step with the platform — when the scanner fleet improves, the repo improves. Version 1.0.0 is the floor, not the ceiling.

Scan responsibly.