xlogs vs ZeriFlow
Both tools scan a live app from its URL, free, with no signup for a basic scan. They check genuinely different things, and ZeriFlow is broader than xlogs on configuration. This comes from us, so read it knowing we make xlogs. Every claim below was checked against ZeriFlow's own pages in August 2026.
Scan your app with xlogs
They check the setup around your app. We check the app.
ZeriFlow runs 80+ checks across TLS, HTTP headers, cookies, DNS and email authentication, and information disclosure. That is real breadth, and it is more configuration coverage than xlogs has. If you want the widest sweep of transport and header settings, they win that outright.
What their scan does not cover is the application itself. By their own description, the free scan does not test Supabase Row Level Security, database access, or secrets in your shipped JavaScript; source-code analysis is a paid tier that connects to GitHub. Those are the two things that caused every named incident in AI-built apps: an open database and a leaked key.
So the split is clean. They tell you more about how your site is configured. We tell you whether a stranger can read your data or use your keys right now.
Where ZeriFlow is better
- Far more configuration checks (80+ vs our 7), including cookie flags, DNSSEC and DKIM, which xlogs does not check at all
- A much larger library of published security content
- Paid monitoring and CI integration at EUR 9.99/month
| xlogs | ZeriFlow | |
|---|---|---|
| Free scans | Unlimited, no signup | 3 per day, no card |
| Database (Supabase RLS) | Tested anonymously from outside | Not checked |
| Secrets in shipped code | 9 key formats in your live bundle | Paid tier, via GitHub |
| TLS, cookies, DNSSEC, DKIM | Not checked | Yes, and more thoroughly |
| Security headers | 5 headers | 11 header checks |
| Total checks | 8 on the live app, 29 on a repo plus a known-vulnerability lookup, each mapped to something exploitable | 80+ |
| Score | None, by design | 0 to 100 |
| Cheapest paid tier | No paid tier yet | EUR 9.99/month |
| Repo scanning | 29 supply-chain checks on a public repo, read-only | Not stated |
| Access log analysis | Drop an access log: parsed in your browser, never uploaded | Not stated |
Common questions
Which one should I use?
If your app has a database, start with xlogs, because an openly readable table is the thing that actually leaks user data and their free scan does not test for it. If you want the broadest sweep of TLS, cookie and DNS configuration, ZeriFlow covers far more of that than we do. They are close to complementary.
Does xlogs really run only 7 checks?
Yes, and we would rather say so than inflate the number. Every one maps to a condition someone can act on, and we publish exactly what we do not check. A larger count is easy to produce by adding checks that are easy to pass.