Tech Radar

Tech Radar scans your website by analyzing HTML, HTTP headers, JavaScript and CSS to identify all technologies in use. It then compares these technologies with databases of known vulnerabilities (CVE), calculates maintenance and license costs, and generates a complete report.

Yes, the scan is completely secure. We do not access sensitive data, we do not save passwords or confidential information. We only analyze publicly accessible information from your site's frontend. Results are visible only to you and are not shared.

Tech Health Score is a score from 0 to 100 that evaluates the overall status of your technology stack. It takes into account: security vulnerabilities, obsolete technologies, performance and stack complexity. The higher the score, the healthier your site.

If the report highlights critical vulnerabilities: 1) Immediately contact your developer/agency, 2) Update vulnerable technologies to the latest secure versions, 3) If you cannot update, consider temporarily disabling the affected functionality, 4) Evaluate migration to more secure platforms like Bsite. We can help you with a free consultation.

XSS is a vulnerability that allows attackers to inject malicious JavaScript code into web pages viewed by other users. This can lead to theft of session cookies, credentials, or execution of unauthorized actions. It is prevented by validating and sanitizing all user input and using Content Security Policy (CSP).

SQL Injection is an attack technique that exploits unvalidated inputs to execute arbitrary SQL queries on the database. It can lead to data theft, modification or deletion of sensitive information. The main defense is to use prepared statements (parameterized queries), strict input validation and principle of least privilege for database users.

CSRF is an attack that forces an authenticated user to perform unwanted actions on a web application. The attacker tricks the victim into clicking a link or visiting a malicious page that sends requests to the target site using the victim's credentials. It is prevented by using unique CSRF tokens for each session and verifying the origin of requests.

RCE is one of the most serious vulnerabilities that allows attackers to execute arbitrary code on the server. It can lead to complete system control, data theft, malware installation or use of the server for attacks on other systems. It is prevented by keeping software updated, validating input, limiting execution privileges and using sandboxing.

DDoS (Distributed Denial of Service) overloads a site with traffic from multiple sources simultaneously, making it inaccessible. Attackers use botnets (networks of compromised computers) to generate massive requests. Defense includes CDN with DDoS protection, rate limiting, application firewalls (WAF) and anomalous traffic monitoring.

MITM is when an attacker intercepts communication between two parties to spy on or modify exchanged data. It can happen on unsecured public WiFi networks or through DNS poisoning. The main defense is to use HTTPS with valid certificates, HSTS (HTTP Strict Transport Security), avoid unsecured networks and verify SSL certificates.

The technologies a site is built on, read from the headers, the markup and the resources it loads: server, framework, content management system, analytics and libraries, with their version where it is visible.

A Common Vulnerabilities and Exposures entry is the public identifier of a known security flaw. Matching the versions found against that catalogue says which published problems could apply to the site.

Not on its own. The match is made on the version declared, which can be wrong, and a patch is often applied without the version string changing. It is a starting point for checking, not a verdict.

To a server of ours, and we say so plainly because this is one of the few tools that cannot run inside the browser: the processing needs a real machine. The file is uploaded, processed, and deleted automatically within an hour. Nobody opens it, it does not end up in an archive, and it is never used to train anything.

No. The file does the job you asked for and then it is gone: we do not link it to you, we do not resell it, we do not pass it to third parties and we do not train any model on it. Most other Binatomy tools upload nothing at all and work only in your browser; this is one of the few that cannot.

We do not profile you: there is no account to create, we never ask for your email to use a tool, and we keep no profile of what you do. We are an Italian company and we work under the GDPR and the other European rules, with the privacy notice and the consent request in plain sight. One thing we say in full rather than hiding it behind a slogan: the ads on the page are Google's, and Google may use cookies to personalise them. You decide from the consent banner: if you say no the ads stay, but they are not personalised, and the tool works exactly the same.

From the ads on the page, and that is all. We do not sell your data, there is no hidden paid plan, there is no limit that eventually asks for your card, and you do not have to sign up. The ads pay for the servers and for the time we spend writing the tools: that is how we can keep them open to everyone.