You shipped it in a weekend.
Who else can read it?
SecScan runs 127 security checks against a live web application and grades what it finds A–F. This site is the other half: what each finding means, why it carries the severity it does, and the exact change that clears it. Free to read, no account.
- 127
- checks, every scan
- 25
- engine modules
- 0
- tiers or upsells
Built for apps shipped faster than they were audited
AI builders are good at features and consistently silent about security. These are the findings that come back Critical most often.
Backends with no access rules
Supabase tables that answer anonymous reads because Row Level Security was never enabled — CVE-2025-48757. Also Firebase, PocketBase and Appwrite.
Read more →Keys in the bundle
A service_role JWT or an AWS secret in client-side JavaScript, matched against 32 credential patterns — while public-by-design keys are left alone.
Read more →Config you deployed by accident
78 paths probed for .env files, .git directories, actuators and admin panels, each confirmed against the site’s own catch-all before it counts.
Read more →Server props left in the HTML
Next.js serialises server data into __NEXT_DATA__. Nine distinct secret types get read straight out of the page, no JavaScript required.
Read more →There are no tiers
Every scan runs every check. What changes how deep it reaches is access, not price.
Domain verification
All active probingCredentials
The surface behind the loginA second account
Broken access control (OWASP A01)An out-of-band collector
SSRF detection (OWASP A10)Start here
How a scan works
The six stages, the domain-verification gate, and the safety rules that keep active probing from changing your data.
ReportsReading your report
The AI-written analysis, and fix prompts generated for Lovable, Bolt, Next.js, WordPress or Supabase specifically.
MonitoringContinuous monitoring
Rescans on a cadence that follows your grade, daily CVE matching with EPSS scoring, and certificate expiry alerts.
Guides
Missing Content-Security-Policy
What a Content-Security-Policy header does, why SecScan reports its absence as High, and how to ship one without breaking your app.
HighCookie flags: Secure, HttpOnly, SameSite
Why a session cookie missing Secure is High while the same gap on an analytics cookie is Low, and how to set all three flags correctly.
CriticalSupabase tables readable with the anon key
CVE-2025-48757: how a Supabase project ships with Row Level Security off, why the anon key is not the problem, and how to confirm and fix it.
HighSPF, DKIM and DMARC
Three DNS records decide whether anyone can send email as your domain. What SecScan checks, and the exact records to publish.
CriticalExposed .env files and source maps
Two ways a deploy publishes things it never meant to: config files served as static assets, and source maps shipped next to production bundles.
Scanning happens on secscan.us
This domain is documentation only — it holds no accounts and runs no scans. Point SecScan at a site you own, verify the domain, and it returns a graded report in a few minutes. Free during early access.
Start a scan →