Free check · no signup

Free live-site security check

Paste your app's URL. In under a minute we look at your site from the outside, exactly like any visitor could: security headers, an exposed /.env or /.git, secret keys sitting in your public JavaScript, and whether your Supabase tables can be read by someone who isn't logged in.

Only scan sites you own or are allowed to test. The check is passive: a handful of normal GET requests, no logins, no writes, no guessing paths. We show key types with masked values only and never display or store your data. Limit: 6 checks per hour.

What the free check can't see

It only sees what your live site serves. Keys in your git history, server code, database policies that only fail for logged-in users, vulnerable packages and missing auth on API routes need a look at the code. That's what the $39 Preflight Security Report does, with a copy-paste fix prompt for every finding. See a sample report.

Automated, best-effort and not a pentest. It may miss issues or flag false positives.