Your first scan, end to end

1. Sign in with the email you redeemed with — your tier is already active (or sign up with that email and it attaches automatically).
2. Create a project and add a target you own (or have written permission to scan). Every scan asks you to confirm that authorisation with a checkbox — scanning sites you don't own is prohibited.
3. Run the scan. In a few minutes you get all five modules — recon, ports, TLS, web audit, directory discovery — as one 0–100 score with severity-ranked findings.
4. Work the findings top-down. Each finding carries the evidence captured and the concrete fix. Check the Ghost Files findings early: archived copies of .env/.git/backup files stay public until the archive copy is dealt with, even after you delete the original.
5. Prove the fix. On Pro and Team, click Prove-It-Fixed on a finding after you've fixed it — BreachHunter re-checks just that item and stamps it VERIFIED FIXED with a timestamp.

An honest limit, stated up front: BreachHunter is assessment-only — it does not exploit vulnerabilities, brute-force credentials, fuzz, or run denial-of-service tests, and it is not a penetration test. Findings are evidence-backed signals with fix guidance, not guarantees.