Run curl qsa.sh for a one-command external security scan of your server's own public IP — naabu, nmap + vulners, and nuclei map your open ports, service versions, and known CVEs, streamed straight to your terminal in ~30 seconds. See exactly what the internet sees of your host: no account, nothing stored. Free scans run live; paid Pro (all 65,535 ports, async) and one-time Deep (the full nuclei firehose, emailed) dig deeper uncovering vulnerabilities below the surface.
The curl detail matters here. Returning text is very different from pipe-to-bash, and the abort window is a nice trust-building touch for a security tool.
honestly the one-curl approach is kind of genius — no signup wall, just instant results streamed to your terminal. love that the free scan stays honest about what the internet actually sees instead of burying the real findings behind a paywall.
This i s great! Would love to try it! ...but .....Is it opensource? I couldnt find a github link. Runing curl is in it self a security risk. Basically you allow anything to run on your computer. No gatekeeper nothing. So having it be closed source is a very red flag 😅. Its fine to do from big vendors like claud eor openai. But small vendors, opensource + curl is a must. IMO. Thanks 🙏
Seeing my own setup the way a stranger on the outside would is oddly reassuring, and I like that it just tells me plainly what looks open without any fuss.
Nice that curl here just streams text back, no piping into bash like typical installers. The 15-second abort window before scanning starts is a smart consent mechanism too.
Really like how frictionless this is. curl qsa.sh scanning the IP you're calling from means it's guaranteed your own host with no account or consent faff, which is a genuinely clever bit of design, and not retaining results is the right call for trust.
One question from my corner: for those of us mostly on serverless/edge now (Cloudflare Workers and the like) where there's no box with an open IP to point at, is there a version of this that makes sense, or is it firmly aimed at VPS/server setups? Either way, nice work.
About qsa.sh on Product Hunt
“External security scan of your own IP, in your terminal”
qsa.sh launched on Product Hunt on July 28th, 2026 and earned 110 upvotes and 19 comments, placing #17 on the daily leaderboard. Run curl qsa.sh for a one-command external security scan of your server's own public IP — naabu, nmap + vulners, and nuclei map your open ports, service versions, and known CVEs, streamed straight to your terminal in ~30 seconds. See exactly what the internet sees of your host: no account, nothing stored. Free scans run live; paid Pro (all 65,535 ports, async) and one-time Deep (the full nuclei firehose, emailed) dig deeper uncovering vulnerabilities below the surface.
qsa.sh was featured in Developer Tools (516.6k followers), Business Intelligence (3.7k followers) and Security (2.8k followers) on Product Hunt. Together, these topics include over 84.9k products, making this a competitive space to launch in.
Who hunted qsa.sh ?
qsa.sh was hunted by Daniel J. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how qsa.sh stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Daniel J
The curl detail matters here. Returning text is very different from pipe-to-bash, and the abort window is a nice trust-building touch for a security tool.