Free · instant · passive

Free instant scan

Find out in seconds whether your vibe-coded app leaks secret keys or is missing basic security headers. You get a severity summary and your top findings in plain English — free, no signup.

Passive and read-only: we fetch your page and its same-origin JS bundles, nothing else. Secret values are never shown or stored. Results appear here — email is optional.

Only scan apps you own or are authorized to test. Limits: about 5 scans per hour per visitor and one fresh scan per site every 10 minutes (repeat requests get the cached result). Want to verify your Supabase grants and RLS yourself? Use the SQL self-check guide.