Enter your URL. We scan from the outside — without seeing your code — and you get a report of what's safe, what could be better, and what's broken or dangerous right now. With a fix prompt you paste straight into your AI tool.
// why this matters
A generated app runs. Great. But the things that break or endanger production don't show up in the preview. Here's what we find most often:
Row Level Security off, and the public anon key reads everything. Your user data, emails, tokens — queryable by anyone.
A service_role key, Stripe live secret or OpenAI key in the JS bundle. Ironically, source maps even leak your entire source code.
Trackers and cookies fire before consent, no working cookie banner, no privacy policy. In the EU that's not optional.
8 MB homepages on mobile, dead contact forms, JavaScript errors, or accidentally set to noindex — invisible to Google.
// 118 checks, in two levels
Everything your site serves publicly, we check right away. The heavy work — actively testing whether a leak is truly exploitable — only runs after you've proven the domain is yours.
Validity, chain, protocols, weak ciphers, HSTS, mixed content.
CSP, X-Frame-Options, CORS wildcards, and insecure cookie flags.
Supabase and Firebase config, Stripe/LLM/AWS keys and source maps in the bundle.
Core Web Vitals, page weight, caching, render-blocking — on a mobile profile.
Broken links, dead forms, images that don't load and console errors.
Title, meta, Open Graph, sitemap, canonical and unintended noindex.
Color contrast, alt text, labels and landmarks — legally relevant since the EAA.
Trackers and cookies before consent, cookie banner and privacy policy.
SPF, DKIM, DMARC, CAA, orphaned records and the hosting fingerprint.
Whether your database can be read, inserted into or modified unauthenticated.
Publicly readable Firebase, S3 or GCS buckets.
.env, .git, backups and config files that are reachable.
Admin panels, debug stack traces, unprotected pages and open endpoints.
Unlimited uploads and missing limits on sensitive endpoints.
Port scan and open databases — only on your own VPS.
// no hassle
No account, no install. We fetch your site the way an ordinary visitor does.
Headers, TLS, your JS bundle, DNS and a real browser render. You don't have to share any code.
Every finding comes with an explanation at your level plus a ready-made prompt you paste into your AI tool. Rescan until it's green.
// fair model
The scan and your critical findings are free and visible — even the shocking ones. Pay, and you get the exact details, the fix prompts and unlimited rescans. VAT is charged per country by Paddle.