Every check we run, split by what it takes to use it. Checks that need no ownership run on every scan, for any public website. Owner checks send probing requests, so they run only after you verify your domain. Paid checks are the advanced ones we are building next.
22 checks in 6 modules
| SEVERITY | CHECK | MODULE | ID | No ownership needed(18) | Website owner only(4) | Paid(5) |
|---|---|---|---|---|---|---|
| CRITICAL | Environment file (.env) is publicly readable Anyone can download these variables — usually database URLs and API keys. Bots scan for | Exposed files | EXP-001 | No ownership needed | · | · |
| CRITICAL | Git repository is exposed
| Exposed files | EXP-002 | No ownership needed | · | · |
| CRITICAL | Secret keys exposed in client-side code Private API keys were found in JavaScript that is sent to every visitor. Anyone can copy them and use your accounts. | Client-side secrets | SEC-001 | No ownership needed | · | · |
| CRITICAL | Supabase service_role key exposed The service_role key bypasses Row Level Security completely. Anyone who has it can read and modify every table. | Client-side secrets | SEC-002 | No ownership needed | · | · |
| CRITICAL | TLS certificate expired or expiring soon When the certificate expires, browsers show a full-page security warning and most visitors leave. | Transport & TLS | TLS-002 | No ownership needed | · | · |
| HIGH | CORS reflects any origin Your server echoes any Origin back in Access-Control-Allow-Origin. With credentials allowed, any website can read your users' data. | HTTP headers | COR-001 | No ownership needed | · | · |
| HIGH | HTTPS not enforced The site is not served over HTTPS, or plain HTTP does not redirect to HTTPS. Traffic can be read or modified on public Wi‑Fi. | Transport & TLS | TLS-001 | No ownership needed | · | · |
| HIGH | TLS certificate is not trusted Browsers reject the certificate (wrong hostname, self-signed or incomplete chain), so visitors see a security warning. | Transport & TLS | TLS-003 | No ownership needed | · | · |
| MEDIUM | Cookies missing security flags Cookies without Secure, HttpOnly or SameSite can be stolen over HTTP, read by injected scripts, or sent with cross-site requests. | HTTP headers | CK-001 | No ownership needed | · | · |
| MEDIUM | SPF record missing Without SPF, receiving mail servers can't tell which servers may send email for your domain, which makes spoofing easier. | DNS & email | DNS-001 | No ownership needed | · | · |
| MEDIUM | DMARC missing or not enforced Without an enforcing DMARC policy, attackers can send email that appears to come from your domain. | DNS & email | DNS-002 | No ownership needed | · | · |
| MEDIUM | Content-Security-Policy missing or weak Without a strong CSP, any injected script runs with full access to your page and your users' sessions. | HTTP headers | HDR-001 | No ownership needed | · | · |
| MEDIUM | Clickjacking protection missing Other sites can load your pages in a hidden frame and trick users into clicking buttons. | HTTP headers | HDR-002 | No ownership needed | · | · |
| MEDIUM | HSTS missing or too short Without Strict-Transport-Security, a visit can be downgraded to HTTP by an attacker on the same network. | Transport & TLS | TLS-005 | No ownership needed | · | · |
| LOW | No CAA record Any certificate authority can issue certificates for your domain. CAA restricts issuance to the CAs you actually use. | DNS & email | DNS-004 | No ownership needed | · | · |
| LOW | Baseline security headers missing X-Content-Type-Options and Referrer-Policy are cheap defaults that block MIME sniffing and stop full URLs leaking to other sites. | HTTP headers | HDR-003 | No ownership needed | · | · |
| LOW | Server or framework version disclosed Version banners help attackers match your stack to known vulnerabilities. | HTTP headers | HDR-004 | No ownership needed | · | · |
| LOW | Source maps publicly accessible Your original source code can be reconstructed from the | Client-side secrets | SEC-004 | No ownership needed | · | · |
| CRITICAL | Supabase tables readable without login Using the public anon key from your site, we could read rows from these tables. Row Level Security is off or a policy allows public reads. | Backend (Supabase / Firebase) | BAAS-002 | · | Website owner only | · |
| CRITICAL | Firebase Realtime Database is publicly readable Your database rules allow reads without authentication, so anyone can download the data. | Backend (Supabase / Firebase) | BAAS-004 | · | Website owner only | · |
| HIGH | Supabase storage buckets are listable Anyone with your public key can list files in these buckets, which often exposes user uploads. | Backend (Supabase / Firebase) | BAAS-003 | · | Website owner only | · |
| HIGH | Firebase Storage bucket is publicly listable Your Storage rules allow listing files without authentication. | Backend (Supabase / Firebase) | BAAS-005 | · | Website owner only | · |
| CRITICAL | Full vulnerability template scan Runs thousands of safe templates for misconfigurations, exposed panels, default logins and known CVEs. Never runs denial-of-service or intrusive templates. | Advanced scan | ACT-001 | · | · | PaidComing soon |
| CRITICAL | Leaked key still works For keys found in your client code, a harmless read-only call (such as "who am I") tells you whether the key is still live, so you know exactly what to rotate. | Advanced scan | SEC-007 | · | · | PaidComing soon |
| HIGH | API endpoints without authentication Reads your OpenAPI/Swagger or GraphQL schema and finds endpoints that return data without logging in. | Advanced scan | ACT-003 | · | · | PaidComing soon |
| HIGH | Authenticated scan and IDOR With two test accounts you provide, checks whether one user can read or change the other user's data by changing an ID. | Advanced scan | ACT-004 | · | · | PaidComing soon |
| HIGH | AI business logic testing An AI agent walks through flows like sign-up, checkout and coupons, looking for skipped steps, negative amounts and missing limits on AI endpoints. | Advanced scan | AI-001 | · | · | PaidComing soon |