Free mini security scan for your AI-built app
Paste your live URL and get your top 3 security issues in about 30 seconds. Safe, passive checks only: we look at what any visitor's browser can already see.
Your results
The full report covers every finding ranked by risk, deeper checks (including your public code and Supabase RLS), and a plain-English explanation and copy-paste fix prompt for each.
Get the full report for £29What the mini scan checks
- Security headers: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.
- HTTPS: whether plain http:// redirects to https://.
- Exposed files: whether
/.envor/.git/HEADcan be downloaded. - Leaked keys: Supabase
service_roleor anon keys, Stripe, AWS, OpenAI and other secret keys in your page's own JavaScript. Keys are always shown masked. - CORS: whether your server lets any website read its responses.
Questions
Is it safe for my site?
Yes. We make a handful of normal GET requests, just like a visitor's browser: your page, its own JavaScript files, the http:// version of your address, and /.env and /.git/HEAD. No attacks, no logins, no form submissions and no crawling.
What do you store?
Only a one-way hash of the domain, the date and the number of findings by severity, so we can prevent abuse and count usage. We don't store your URL, the findings or your IP address. Your email is only stored if you tick the newsletter box.
Is this a full security audit?
No. It's a quick external check of common mistakes. The full report goes deeper, and neither replaces a professional penetration test.
What's in the full £29 report?
Every finding ranked by risk, deeper checks including your public code, plain-English explanations and copy-and-paste fix prompts.