Frequently asked questions

It scans your website — or the API / database backend behind your app — for things an attacker can already reach from the outside. It leads on the exposures most scanners miss — leaked privileged keys and publicly-readable backend data — and around them runs a full external-posture check: TLS, security headers and cookies, email authentication, known-vulnerable library and CMS versions, exposed files, open cloud buckets and more. The scan, the severity scoreboard, every informational finding, and a full profile of your site are free. The negative findings — the actual High, Medium and Low issues, each with its evidence and a fix — are unlocked with a one-time payment, or included if you subscribe to monitoring.

Yes, it's safe. The standard scan is strictly passive recon — we read what your site already serves to the public, never run code on your site, and never log in. (Our deep tier does log in — but only ever on a domain you've verified, using test accounts you create in your own app. See our methodology page.)

Our sharpest checks target two backend exposures: (1) leaked privileged keys — a Supabase service_role or secret API key shipped to the browser, which hands an attacker your whole database; and (2) publicly-readable backend data — tables that answer an anonymous request with data they shouldn't. We classify keys by role, so public, client-safe keys are never flagged. Around those, every scan runs a full external-posture surface — TLS, security headers and cookies, CORS, email authentication (SPF/DMARC), known-CVE library and CMS/plugin versions, exposed files like .env or .git, open S3 / GCS / Azure buckets, and subdomain-takeover signals — each mapped to the OWASP taxonomy; the full list is on our “What we scan for” page. For apps with logins, our deep tier goes further — using two test accounts you create in your own app, it checks whether one logged-in user can reach another user's data (broken object-level authorization). It's a separate premium report ($300 first, $150 for repeats on the same property), and like the standard report you only pay when there's a negative finding to reveal. See how it all works on our methodology page.

It's sharpest on apps that reach a database or API straight from the browser or a mobile client — where one backend misconfiguration leaks in public. Best fit: apps built on a backend-as-a-service (Supabase, Firebase, PocketBase, Appwrite, AWS AppSync, Nhost); single-page apps (React, Vue, Angular, Svelte) calling a public REST or GraphQL API; and mobile or desktop app backends, where you can paste the API base directly. It also runs on any website — WordPress and CMS sites get known-CVE version and plugin checks, and every site is checked for leaked keys in JavaScript, exposed files like .env or .git, and open S3 / GCS / Azure buckets. Sites fully behind a login wall or an aggressive bot-wall may come back as an honest “scan incomplete” rather than a guessed verdict.

Free: the scan itself, the severity scoreboard, every informational finding in full, and a profile of your site's stack and what we checked. Paid: the negative findings — the High, Medium and Low issues — each with its evidence and a plain-English fix. You only pay when a scan actually has negative findings, and only after you've proven you own the domain, so the exploitable details go to the site's owner and no one else. Because running scans is free, there's a fair-use limit on how many you can start per day; normal use won't reach it.

A report is $50, one-time — charged only to unlock a scan's negative findings, and never to run a scan or see the scoreboard, the informational findings or the site profile. If you expect to unlock more than one, prepaid packs bring that down: 5 reports for $200 ($40 each) or 10 for $350 ($35 each), usable on any domain you've verified. If you want one site watched continuously, monitoring is $100 per month per domain and includes the reports — about $25 a scan, the cheapest option.

Yes — $100 per month, per domain. We re-scan the site automatically on a weekly schedule (4 scans a month), email you when each scan finishes, and include every report free while the subscription is active, so there's nothing to unlock. Each scan is compared to the one before it, so you see what changed — a new High that appeared after a deploy is the thing you most want to hear about early. Scans you run yourself don't count against the monthly allowance, and you can cancel anytime from the billing portal.

So we only ever hand exploitable details to the site's actual owner — not to someone targeting you. You prove ownership with a meta tag on your homepage or a DNS TXT record (your choice).

For a single report, your card is authorized when you pay but only charged after ownership is verified. If you can't verify the domain, the authorization is released and you're not charged — so we never bill for a report we can't deliver. Prepaid packs and a monitoring subscription are ordinary purchases on a domain you've already verified, so those are charged when you confirm.

No. Every scan requires signing in and verifying you own the domain first — with a meta tag on your homepage or a DNS TXT record. We only ever probe sites whose owners have authorized it.

Every negative finding — High, Medium and Low — with its evidence and a plain-English explanation of the risk and how to fix it, each tagged with its OWASP category and a detection-confidence label (Confirmed when we observed the issue directly, Potential when we inferred it). The report is headlined by a plain A–F grade set by a weakest-link rule — your worst finding sets it — and it spells out exactly which findings would move it up. Evidence is redacted to prove the finding without exposing the live secret. Informational findings are already shown to you for free.

Encrypted scan evidence is automatically deleted after 30 days, always. The minimized finding record (severity, title, and a redacted teaser — no raw evidence) is kept so your scan history and monitoring stay available, until you delete it; you can delete any scan or your whole account anytime from the dashboard. For paid scans we also keep a minimal billing record (the property, date, and amount — no findings or evidence) so your receipts and billing history stay accurate.

No. It's automated, passive security recon focused on a few high-impact exposures. It's a fast, cheap first look — it complements, but doesn't replace, a human-led penetration test. We never claim a site is “secure.”