Free tool
What your site tells an attacker for free
Paste a URL. We read the headers, the transport setup and the JavaScript your page serves to everyone, then tell you plainly what is exposed. No signup, nothing stored, and it only looks at what a browser already sees.
Passive only. We never probe for unlinked files, and nothing is stored.
What it checks
Eleven things, all visible from outside
Content Security Policy
Present, and whether it weakens itself with unsafe-inline or unsafe-eval.
HTTPS and HSTS
Whether the site is encrypted at all, and whether browsers are told to insist on it.
Clickjacking protection
X-Frame-Options or a frame-ancestors directive.
Cookie flags
Secure, HttpOnly and SameSite. A cookie without HttpOnly can be read by any script on the page.
Credentials in public code
Stripe, AWS, Google, GitHub, Slack, SendGrid and OpenAI-style keys, and private key blocks, matched against known formats in your HTML and your own scripts.
Supabase and Firebase use
Detected, with a plain warning that your protection lives in rules a scan cannot see.
Mixed content
Resources pulled over plain HTTP on an encrypted page.
CORS policy
Whether any origin is allowed to read responses.
Version disclosure
Server banners that tell an attacker which exploits to try first.
Outdated libraries
Known-risky versions, starting with jQuery below 3.5.
Referrer and permissions policy
How much of your URLs leak, and what embedded content may access.
Being straight with you
This finds the easy half
Every check here looks at the outside of your application. That matters, and fixing these is cheap. But the findings that actually leak customer data are on the inside: an endpoint that never checks whether this user owns the record they asked for, a database rule left at its permissive default, a backend token with far more access than it needs. No external scanner can see any of that, including this one, and any tool that implies otherwise is selling you comfort.
If your product was largely written by AI, those inside problems are the likely ones. That is what the AI code security audit is for.
FAQ
Common questions
Is this safe to run on a site I do not own?
Yes, because it is passive. Every request it makes is one your browser already makes when it loads the page: it reads the response headers, the HTML, and the JavaScript files that page links to itself. It never guesses at URLs, never probes for files like .env or .git, and never sends anything to a form. We built it that way on purpose, because probing a domain you do not own is a different thing legally, and a public tool cannot verify ownership.
Do you store my results?
No. The scan runs, the result is returned to your browser, and nothing is written down. We do not keep the page contents and we do not keep whatever the secret check matched.
It says I have no problems. Am I secure?
No, it says the outside of your building looks tidy. This checks headers, transport, cookies and publicly readable code. It cannot see your authorisation logic, your database rules or your server-side permissions, and that is where real breaches come from.
Why did it fail to reach my site?
Usually an expired or misconfigured TLS certificate, or bot protection blocking an unfamiliar client. The first of those is itself a finding worth fixing.
Let's talk
Tell us what you're building.
Get a free 30-minute strategy call. You'll leave with a clear plan, a realistic estimate and our honest opinion — whether or not you work with us.
- Email usmail@voliom.com