Scan your app

One address, one minute, no account. You will see the grade before you give us anything.

What the free scan looks at

Only what any visitor to your app can already see. No login, no code, nothing installed.

• Keys left in your JavaScript

  Your app sends script files to every browser that opens it. We read them for keys that were meant to stay on your server. One AI-built app in twenty-three ships one.

• Databases that answer strangers

  We ask whether a small set of commonly named tables will return a row to somebody who is not logged in. We record that they answered and what the columns were called. Never the data itself.

• Files that should not be public

  Addresses like /.env and /.git that sometimes get deployed by accident and hand over everything at once.

• Security headers

  The handful of settings that stop your app being framed by somebody else’s site, or loaded over an unencrypted connection.

• Source maps

  Files that let anyone read your original code rather than the compiled version. Thirteen per cent of scanned apps publish them.

• Error pages that say too much

  Stack traces and version numbers in responses, which tell an attacker exactly what you are running.

What it will never do

• It never writes, changes or deletes anything in your app.
• It never stores the contents of a row. If a table answers, we record that it answered and how many rows it claimed.
• It never runs without you ticking the box to say the app is yours.

The free scan only sees what the public internet sees. It cannot read your code, so it cannot tell you whether a logged-in user can reach another user’s data. That needs the full audit.