Website security reviews with evidence and a practical next step. Start free, without an account.
See the finding, inspect what was observed and understand what to change. Try a different finding below.
Synthetic example. No live scan.
Blocking finding
An unauthenticated request returned an environment file. Its contents may include credentials that need to be rotated.
Observed response Example · redacted
GET https://example.com/.env
HTTP/2 200 OK
content-type: text/plain
APP_ENV=production
DB_HOST=[redacted]
DB_PASSWORD=[redacted]Example data, not a review of a real website or application.
The same request now returns 403. This finding is no longer observed; the remaining checks still determine the result.
The previous observation stays in the history.HTTPS, browser protections, exposed information, email signals and privacy observations. Start with a domain; no website login required.
Review supported source, dependencies and secrets. Keep findings tied to the reviewed commit. Workspace setup and repository access are required.
Compare configured read access across synthetic users and tenants. Requires a verified domain, consent, declared resources and short-lived test sessions.
Different scopes answer different questions. A public scan cannot assess private authorization or prove an entire application is secure. Read the methodology
Separate actionable risks, maintenance advice and checks that still need evidence.
Example review decision
BlockedTake the recommended next step to your developer. A recommendation does not modify your code or website.
Example remediation handover
Restrict public file accessRecord a new observation without losing the old result. Keep its scope, coverage gaps and reviewed version visible.
Example observation history
New observation saved. Other checks and gaps remain part of the decision.
Enter a public domain. Follow the real review states, then read the findings and their limits.
Sign in to save the review, inspect authenticated evidence and keep your history.
See beta access & limitsEach workspace includes ten new website review requests per calendar month (UTC). Shared public limits also apply. Paid subscriptions are not currently offered.
No. A result describes the checks that ran within a declared scope. Unsupported behavior and missing evidence stay outside that conclusion. A high observed score is not a penetration test or a compliance certificate.
Yes, if it is publicly reachable. The public scan checks observable behavior regardless of how the website was built. Source review and authenticated application checks are separate, configured scopes.
A verified domain, explicit consent, declared read-only resources and fresh synthetic test sessions. The configured matrix checks expected access across those roles and tenants. It does not perform write operations or prove all business logic safe.
Anyone with its seven-day public link can read the limited summary. Public summaries omit raw evidence and secret values. Sign in from the browser that started the review to save it to your account.
The review supplies recommended next steps. Supported workspace tools can prepare remediation material for review. No repair is ordered automatically; repository writes and specialist work require separate scope and authorization.
The beta is free. Public reviews have browser and shared limits; each workspace includes ten new website review requests per calendar month (UTC). Paid subscriptions are not currently offered.