Website security report
Works with any website: a site built with Lovable, Bolt, v0 or Replit, a WordPress blog, a Next.js app on Vercel, a shop on your own server. Prove you own it, and we review it the way a careful visitor would, then tell you what to fix in plain English, with the exact setting for your host.
What it checks
- Secrets & exposed files: API keys in your public JavaScript (secret vs. publishable keys), secret-named VITE_/NEXT_PUBLIC_ variables, downloadable .env and .git, source maps.
- App logic in the browser: admin and paid-feature checks that only run in the browser, prices sent from the browser to checkout, AI APIs called directly from the browser, leftover dev settings and test logins, public preview copies of your app.
- Website setup: HTTPS and redirects, security headers, cookies, CORS, mixed content.
- Domain & email: SPF, DMARC and CAA records, leftover subdomains.
- Libraries: front-end libraries with known vulnerabilities, and the version that fixes them.
- Forgotten pages: backups, logs, debug and admin pages left public.
- Third-party scripts: every outside script your pages load, and risky ones.
- Database: if your app talks to Supabase or Firebase from the browser, a reminder of the rules that must protect it (we don't query it).
- Optional database tests: using Supabase or Firebase? Add your own test accounts and we check whether other users can read data they shouldn't.
What it never does
- No logins and no form submissions on your site.
- Read-only: GET and HEAD requests only, within a fixed request limit.
- Nothing runs until you prove you own the site (meta tag, file or DNS record).
- Page contents aren't stored. Secrets are shown masked.
$19 once, including 20 runs over 30 days so you can fix things and check again. See an example report.
- Start
- Prove ownership
- Database tests (optional)
- Pay $19
- Run report
Which site?
Save this link
It's the only way back to your report. Anyone with it can see the report, so keep it private.
Prove you own
Add one of these to your app, publish, then press Check. You can remove it afterwards.
Meta tag (easiest for Lovable, Bolt, v0, Replit)
Paste this inside the <head> of your home page's index.html. Ask your AI tool: "Add this exact meta tag to the head of index.html."
Text file
Create this file in your public folder so it loads at the address below, containing only the code.
- Address
- Contents
DNS record (custom domains)
- Type
- TXT
- Name
- Value
Using Supabase or Firebase? Add database tests (optional)
Your report covers your whole site either way. If your app stores data in Supabase or Firebase, we can also test whether strangers or other signed-in users can read it, using test accounts and a test record you create. We only test the backend your site's public code already uses, and only the test records you list here.
Add database tests
Pay and run
The report costs $19 USD once and includes 20 runs over 30 days, so you can fix things and check again.
Run the report
Stripe test mode: this order was paid with a test card.