Find out what your
website is leaking.
Paste any address. We check what that site publishes to the public — its keys, its database, its headers, its certificate, its domain records — and tell you what a stranger could reach, with a fix you can paste into whatever you built it with.
No code access./No repo./No plugin./No terminal.
Run a check.
About twenty seconds. You see the grade immediately — signing in shows you the findings and how to fix them.
Everyone else needs your code. We need your address.
The other scanners in this space are static analysis tools: they read your repository, or install into your editor, and they price by lines of code. That is a real product, and it is not one you can use if your site was built for you by an AI tool, or by an agency two years ago, or by somebody who has since left.
- 1
We read what your site already publishes
The page, the JavaScript it links to, the headers it returns, the certificate it presents, and the DNS records anyone can look up. Exactly what a visitor’s browser downloads — nothing more.
- 2
We work out what stack you are on, and check accordingly
Supabase, Firebase, Mongo, Postgres, WordPress, Rails, Laravel, Next.js, or something bespoke. We do not need to be told: the answer is in what the site serves.
- 3
We tell you what a stranger could reach, and how to close it
Every finding comes with a paste-ready prompt written for the tool you actually built with. Apply it, press “I fixed it”, and we re-run that one check.
The trade, stated plainly: we cannot see a bug in code we cannot read. We detect its symptoms from outside, and label every finding with how certain we are — verified, likely, or unverified. We never guess and call it a fact.
39 checks across 12 areas. All of them free.
Not a subset, not a teaser. Every check runs on every plan including the free trial, and every finding is shown in full with its fix. What you pay for is how often we look and how much history we keep — never which problems we tell you about.
| Area | Checks | What it covers |
|---|---|---|
| Data exposure | 8 | Whether your database or file storage answers to someone who is not logged in. |
| Keys and credentials | 3 | Passwords and API keys that ended up in code your visitors download. |
| Access control | 4 | Whether your login actually protects the data behind it. |
| Connection and headers | 6 | How your app is delivered, and the browser protections it switches on. |
| Code and file exposure | 4 | Source code, configuration, and internal files reachable from the internet. |
| Third-party code | 2 | Outside scripts and outdated libraries running inside your app. |
| Browser-side risks | 2 | Patterns in your JavaScript that let an attacker do more than they should. |
| Domain and email | 2 | Whether someone can send email pretending to be your domain. |
| Search visibility | 5 | Whether Google can find, read, and correctly list your app. |
| Speed | 1 | How heavy your app is and how long a visitor waits. |
| Accessibility | 1 | Whether people using screen readers and keyboards can use your app. |
| Privacy and compliance | 1 | Tracking, cookie consent, and the pages the law expects you to have. |
A handful of checks send a request to your own backend rather than just reading published files — confirming whether a database table actually answers, for instance. Those need proof you own the site, because we will not do that on a stranger’s word. Exactly what our scanner does
A real finding.
From our own deliberately-broken test site, so we can show it unredacted. Findings on your site are never published, shared, or named in anything we write.
Anyone can read your “users” table
We asked the database for the row count of “users” using only the public key that ships in the browser bundle, and it answered: 1,843 rows. No login, no session, no special access.
HEAD /rest/v1/users?select=* → 200, 1,843 rows.
Response body: empty (we asked for a count, not rows).
-- Lock down the "users" table
ALTER TABLE public."users" ENABLE ROW LEVEL SECURITY;
CREATE POLICY "users_select_own"
ON public."users"
FOR SELECT
TO authenticated
USING (auth.uid() = user_id);Note what the evidence says
We asked for a count, so the response body was empty. We learn the table is world-readable and how exposed it is, without a single row of anyone’s data reaching us.
That is not a nicety. It means there is nothing about your users for us to store, leak, or be asked to hand over.
One check fixes the site you had on Tuesday.
Sites built with AI tools do not break once. They re-break, because the thing that fixes your bug is the same thing that reopens the hole.
- 1
You ask for a feature
“Let users share their boards.” Reasonable. Two sentences.
- 2
Your AI rewrites the data layer
It adds a table, adjusts a query, and — to make it work in the preview — relaxes a permission it never mentions.
- 3
The hole reopens, quietly
Nothing errors. Nothing looks different. The site works. Your users’ data is readable by anyone with the key from your bundle.
We check when you deploy, not on a schedule
Connect Vercel, Netlify, or GitHub and we run the moment you ship. If a finding is new since your last deploy, you get an email naming the deploy that introduced it.
And we close the loop on the fix
Apply the prompt, press I fixed it, and we re-run that one check and mark it clear. No PDF, no homework.
We publish what we find.
Every statistic we publish comes from our own checks or carries a linked source — never a number we read somewhere. The first report goes out once we have checked 100 distinct sites, and not before, because percentages from a small sample mislead.
2 of 100 sites checked so far.
We could publish something now. Plenty of companies would. But a security vendor quoting a percentage from a handful of samples is exactly the kind of thing that turns out to be wrong in public.
Every finding is free. You pay for how often we look.
Three full reports to start, no card. After that, plans begin at $7 a month — and prices adjust to where you are, automatically.
| Plan | Price | Scans | Monitoring | |
|---|---|---|---|---|
| Free | Free | 3, ever | — | Start free |
| Watch | $7/mo | 20 / month | Weekly | Details |
| ProMost chosen | $19/mo | Unlimited | Daily + every deploy | Details |
| Agency | $49/mo | Unlimited | Daily + every deploy | Details |
It takes twenty seconds to find out.
No card. Three full reports. Every finding shown in full.
Run a check