Free security checkers
One-purpose checkers for the issues that break AI-built apps. Each one is free, read-only, and needs no signup. Or scan your whole app at once with the box below.
Security headers checkerCheck your site's security headers free: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy. Paste a URL, no signup.Content-Security-Policy (CSP) checkerCheck whether your site sets a Content-Security-Policy header. A missing CSP means no defense against injected scripts (XSS).HSTS checkerCheck whether your site sends the HSTS (Strict-Transport-Security) header. Without it, connections can be downgraded to HTTP.Source map exposure checkerCheck whether your production site serves public source maps, which let anyone reconstruct your original code from the browser..env and .git exposure checkerCheck whether your live site is serving files that should never be public, like .env (your secrets) or the .git folder (your code history).API key leak checkerCheck whether a secret API key (Stripe, OpenAI, AWS, Supabase service key) is exposed in your live app's JavaScript.
Or scan the whole app
One scan runs every check above. Free, read-only, no signup.