NuajLens Free
Inventory, scheduled scans, findings that persist between runs, and a PDF on the way out. One Go binary holding a web console, a datastore, a report engine and a scheduler — free to download and run.
Scope
So the inventory is the only source of targets. There is no free-text target field anywhere in the product — not in the scan form, not in the API, not behind a flag. A host that is not a registered asset cannot be reached, which removes the failure mode structurally instead of with a warning dialog.
Inventory
An entry holds a comma- or line-separated list. An office network with three subnets is one asset, not three — and the same range can sit in a nightly critical-only group and a monthly full audit at once.
Guardrail
Custom profiles pass extra arguments to the engine verbatim, with one
exception: flags that would introduce targets of their own — -u,
-target, -list, -resume, -config — are
refused when the profile is saved and stripped again before the scan runs.
Blind spots
The dashboard names enabled assets the scanner has never completed a run against. They contribute no findings, which looks identical to being clean.
How it works
Addresses and ranges you are authorised to test. This list is the scanner's entire world.
Severities, template tags, protocols, rate limit, concurrency, timeout. Four are built in; duplicate one to make your own.
A five-field cron spec, or @daily and @every 6h.
Schedules reload on change — no restart.
A PDF and an HTML summary go out when the scan ends — to your recipients, and to each customer's own.
| Built-in profile | What it is for | Typical cadence |
|---|---|---|
| Exposure Check | Exposed panels, config files, backups, default logins. | Safe to run often |
| Vulnerability Scan | CVEs and known-exploitable issues, medium and above. | Weekly |
| Critical Only | High and critical only. Minimal noise. | Nightly |
| Full Audit | Every template, every severity. Slow. | Monthly, or before an audit |
Console
Progress, request rate and results stream over Server-Sent Events — one direction, reconnects on its own, through any proxy that does not buffer. The dashboard refreshes every five seconds, so counts climb during a run rather than jumping at the end.
Open critical and high — what needs action now.
Longest outstanding critical or high. The number that shows whether anything is being fixed.
Median time to fix over 90 days. Median, so one neglected finding cannot distort it.
Enabled assets never scanned. The blind spots.
| Day | Open critical + high |
|---|
Every finding in the oldest two bands is critical or high. That is the number worth acting on.
Findings
Results are deduplicated by a fingerprint of template, host, matched location and extracted value — so the same problem seen in twenty scans is one row with an accurate first sighting.
| Finding | Host | Severity | Status | First seen | Last seen |
|---|---|---|---|---|---|
| Unauthenticated admin API | 10.0.1.9:8080 | critical | open | 63 d ago | today |
| Exposed .git directory | 10.0.0.7:80 | high | open | 12 d ago | today |
| Default credentials | 10.0.1.9:22 | high | accepted | 41 d ago | today |
| TLS 1.0 accepted | 10.0.1.24:443 | medium | open | 6 d ago | today |
| Weak cipher suite | 192.168.5.2:443 | medium | resolved | 28 d ago | 9 d ago |
| Missing HSTS header | 10.0.1.24:443 | low | false positive | 55 d ago | today |
Resolution
A finding must be missed by two consecutive completed scans before it closes. A template can fail to fire on a dropped connection or a rate limit; one silence is not evidence.
Reach
A Critical Only run never loads a medium-severity template, so its silence says nothing about a medium finding. Resolution considers only findings within the profile's reach. A failed or cancelled scan resolves nothing at all.
Triage
Accept a risk or flag a false positive and the state survives every future scan. Those two statuses are yours — no scan will ever move a finding out of them.
Reports
The message body carries an HTML summary; the attachment carries a cover verdict, severity counts, the highest-priority findings, and what moved since the previous run.
Delivery
Multi-tenant
Built for the operator running one console across a book of clients.
Install
The package bundles its own scan engine, creates the service account, installs a hardened systemd unit, generates a self-signed TLS certificate and starts the service. There is no window in which the console is reachable in plaintext.
Access
There is no licence key, no seat count and no trial timer — but builds are served from download.nuaj.com, which is opened per organisation. Send one email to our helpdesk and we grant your access, usually the same business day.
Debian · Ubuntu
# amd64 shown; arm64 is the same package name # the host answers once your access is granted curl -fsSLO https://download.nuaj.com/d/nuajlens/cli/1.0.0-5/nuajlens_1.0.0-5_amd64.deb sudo apt install ./nuajlens_1.0.0-5_amd64.deb
RHEL · Fedora · Rocky · Alma · openSUSE
sudo dnf install ./nuajlens-1.0.0-5.x86_64.rpm
One directory of state
/opt/nuajlens/ ├── bin/ nuajlens + scan engine ├── nuajlens.conf configuration └── data/ db, scan logs, templates, cert
Backup, migration and removal are each a single path. Uninstall keeps your data; purge asks first, then takes everything.