Is your site hackable?
Find out in 60 seconds.
No tools to install. No code to read. Paste your link, see everything we find.
Works with any site · free · no login
We never log in, submit forms, or touch your database. That needs your verified permission. See a sample report.
Your AI shipped the app. It didn't lock the doors.
The fastest way to see what a stranger can already get to on your site, before it turns into chargebacks, a leaked-data email, or a very public bad day.
Paste your link and you'll know, in plain English, whether:
- the API keys that cost you money (Stripe, OpenAI, AWS) are sitting in your code for anyone to copy
- your .env file (the one with all your passwords) is downloadable by the entire internet
- any random website can quietly read your logged-in customers' private data
- your entire source code is one click away from a competitor
- you're missing the basics that separate a real company from a weekend project
Founders who take their product seriously check this. The ones who don't find out the hard way, publicly.
No scare tactics. We confirm every finding is real before we ever call it critical, so you get the truth about your site, not a wall of red built to upsell you.
Paste your link. 60 seconds, free, no login, no code.
The full technical detail
Exposed secrets in your bundles
Stripe, OpenAI, Anthropic and AWS keys, private keys, and Supabase service-role tokens shipped to the browser. Each validated by prefix, length and entropy (and screened against known demo keys) before we ever call it critical.
Reachable config & repo files
Whether /.env, /.git or config.json are served to the public. Confirmed to be the real file, not a single-page-app catch-all that returns HTML for everything.
Missing security headers
Gaps in Content-Security-Policy, HSTS, X-Frame-Options and X-Content-Type-Options on your live responses.
CORS misconfiguration
A probe request checks whether your API reflects any origin it's asked for with credentials enabled (any site can read authenticated responses) or the null origin bypass. A wildcard origin paired with credentials is flagged too, though browsers refuse to honor that exact combination.
Production source maps
A sourceMappingURL left in shipped JavaScript, which re-exposes your original, un-minified source to anyone.
HTTPS / TLS transport
We read your site only over its live, certificate-validated HTTPS connection, and a missing HSTS header that would weaken it is flagged above.
No false alarms. Supabase anon keys and Firebase web config are public by design. We never flag their mere presence as critical. Whether your access rules are actually open is provable only by an authorized active scan.