For a URL and a technology, passively detects the tech and its version (headers, meta generator, script URLs - read-only, no probing), looks that version up in public CVE databases (OSV/NVD), and reports known CVEs plus a security-header posture. For assets you own or are authorized to test. Up to 3 items per call; failed lookups are not charged.