Free security checkers
One-purpose checkers for the issues that break AI-built apps. Each one is free, read-only, and needs no signup. Or scan your whole app at once with the box below.
Security headers checkerCheck your site's security headers free: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Paste a URL, no signup.Content-Security-Policy (CSP) checkerCheck whether your Content-Security-Policy actually stops injected scripts, not just whether one is set.HSTS checkerCheck whether your site sends the HSTS (Strict-Transport-Security) header. Without it, connections can be downgraded to HTTP.Source map exposure checkerCheck whether your production site serves public source maps, which let anyone rebuild your original code from the browser..env and .git exposure checkerCheck whether your live site serves files usually kept private, like .env (often your secrets) or the .git folder (your code history).API key leak checkerCheck whether a secret API key (Stripe, OpenAI, AWS, Supabase service key) is exposed in your live app's JavaScript.
Or scan the whole app
One scan runs every check above. Free, read-only, no signup.