xlogs vs ZeriFlow
Both tools scan a live app from its URL, free. ZeriFlow asks you to sign in with Google or GitHub before its free scan; xlogs needs no account. They check genuinely different things, and ZeriFlow is broader than xlogs on configuration. This comes from us, so read it knowing we make xlogs. Every claim about ZeriFlow below was re-checked against ZeriFlow's own site on 6 October 2026.
Scan your app with xlogs
They check the setup around your app. We check the app.
ZeriFlow runs 80+ checks across TLS, HTTP headers, cookies, DNS and email authentication, and seven more categories. That is real breadth, and it is more configuration coverage than xlogs has. If you want the widest sweep of transport and header settings, they win that outright.
What their free scan does not cover is the application itself. Their own description of it lists TLS, headers, cookies, DNS and email settings, and does not mention Supabase Row Level Security, database access, or secrets in your shipped JavaScript. Finding secrets is their paid Advanced Scan, which reads your GitHub repository or a ZIP of your code rather than the site you deployed.
So the split is clean. They tell you more about how your site is configured. We tell you whether a stranger can read your data or use your keys right now.
Where ZeriFlow is better
- Far more configuration checks (80+ against our 11), including the TLS certificate, DNSSEC and DKIM, which xlogs does not check at all
- A much larger library of published security content
- Scheduled monitoring that alerts you when the score drops, from 9.99 USD per month, and pull-request scanning in CI (300 scans a month on their 49 USD plan)
| xlogs | ZeriFlow | |
|---|---|---|
| Free scans | 60 an hour from one connection, no signup | 1 quick scan per day, after signing in with Google or GitHub |
| Database (Supabase RLS) | Tested anonymously from outside | Not among their listed checks |
| Secrets in shipped code | 18 key formats in your live bundle | Paid Advanced Scan, from your repo or a ZIP |
| TLS certificate, DNSSEC, DKIM | Not checked | Yes |
| Cookie flags | Secure and SameSite on every cookie your homepage sets, HttpOnly on session cookies | Yes |
| Email spoofing (SPF, DMARC) | Yes, on a domain you control | Yes, plus DKIM |
| Security headers | 5 headers, including whether the CSP restricts scripts | Yes, plus a separate CSP analysis |
| Total checks | 11 on the live app, 35 on a repo plus a known-vulnerability lookup, each mapped to something exploitable | 80+ |
| Score | None, by design | 0 to 100 |
| Cheapest paid tier | No paid tier yet | 9.99 USD per month |
| Repo scanning | 35 supply-chain checks on a public repo, read-only | Paid Advanced Scan: secrets, vulnerable packages, insecure API patterns |
| Access log analysis | Drop an access log: parsed in your browser, never uploaded | Not stated |
Common questions
Which one should I use?
If your app has a database, start with xlogs, because an openly readable table is the thing that actually leaks user data, and their free scan does not list a database check. If you want the broadest sweep of TLS, cookie and DNS configuration, ZeriFlow covers far more of that than we do. They are close to complementary.
Does xlogs really run only 11 checks?
Yes, and we would rather say so than inflate the number. Every one maps to a condition someone can act on, and we publish exactly what we do not check. A larger count is easy to produce by adding checks that are easy to pass.