FREE · OPEN-SOURCE CHECKS · NO REPO ACCESS

Know you're exposed
before attackers do.

Professional-grade security scanning, early CVE warnings matched to your stack, and multi-region uptime monitoring — free for every website, including the ones you vibe-coded last weekend.

✓ Passive scan · ~60s✓ No signup✓ Results private by default
[N]websites monitored
[N]critical issues caught this month
< 2htarget: exploited CVE → your inbox
3+uptime probe regions
// EARLY WARNING SYSTEM

One quiet dashboard. Loud only when it matters.

We watch your site from the outside — the same view an attacker has — and alert you the moment something new is exposed.

Professional scanning

TLS, headers, exposed files, leaked secrets, Supabase & Firebase rules, known CVEs. Verify your domain to unlock active checks.

CVE early warnings

New CVEs from CISA KEV, OSV and GitHub Advisories are matched against your detected stack — no rescan needed.

Change detection

New deploy, new JS bundle, changed DNS? We rescan what changed and only tell you about issues that are actually new.

Multi-region uptime

HTTP, keyword, SSL, port and heartbeat checks from several regions. "Down" only when two regions agree.

// WHAT WE CHECK

Tuned for how apps are built today.

TLS-*TLS & certificatesExpiry, chain, weak protocols, HSTS
HDR-* · CK-* · COR-*Headers, cookies & CORSCSP, clickjacking, cookie flags, wildcard origins
SEC-*Leaked secrets in JSOpenAI, Stripe, AWS, service_role keys, source maps
EXP-*Exposed files.env, .git, backups, debug pages, directory listing
BAAS-*Supabase & FirebaseRLS off, open rules, public buckets
TECH-*Known CVEs & KEVFramework, CMS and JS library versions, EOL software
DNS-*DNS & emailSPF, DMARC, DKIM, CAA, subdomain takeover
REP-*Reputation & integritySafe Browsing, blacklists, injected scripts, defacement
Browse the open check catalog →
// FIX, DON'T JUST FIND

Every finding ships with a fix prompt.

Plain-language explanation, step-by-step fix for your stack, and a ready-made prompt you can paste into Cursor, Claude Code or Lovable.

Next.jsViteSupabaseFirebaseNginxCloudflare
CRITICALSupabase service_role key exposedSEC-002

The service_role key bypasses Row Level Security completely. Anyone who has it can read and modify every table.

AI FIX PROMPT

My Supabase service_role key is in my frontend code. Remove it from the client, use the anon key with Row Level Security policies instead, move privileged operations to a server-side function, and remind me to rotate the key.

// HOW IT WORKS

Three steps. No code access, ever.

01

Scan any URL

Passive, read-only checks of what's already public. Results in about a minute.

02

Verify your domain

DNS TXT record, file or meta tag. Unlocks active scanning only for sites you own.

03

Get alerted early

Critical issues instantly, the rest in a daily digest — wherever your team already is.