Read-only by default See how scans stay safe

The security audit for every web app

Find leaked keys, exposed files and risky settings in minutes, whatever your site is built with. Every finding is explained in plain English, with clear steps to fix it and a prompt for AI coding tools.

Read-only. Won't change or slow your site.

  • 1 free deep scan
  • No credit card
  • Only sites you may test

Security report · example.com

Replay of a real scan

F0/100

example.com

First scan · 164 requests

  • 1 critical
  • 2 high
  • 4 medium
  • 4 low
  • 7 passed

Findings 11 to fix

  • Critical Fixed Your server's source code is published as a static file

    Files like server.js are downloadable, which means the folder your server runs from is also the public web folder. Anyone can read your backend code, and anything the app saves in that folder (uploads, exports, backups, .env) is downloadable by name.

    How to fix · step 1Serve static files from a dedicated folder (e.g. public/ or dist/), never from the project root.

    Fix prompt for AI coding tools

    I'm building this app in Lovable. A security scan of my live site https://example.com found a problem I need you to fix. Problem: Your server's source code is published as a static file. …

  • High Not rechecked A library with known vulnerabilities is in use
  • High Plain HTTP does not redirect to HTTPS
  • Medium No Content-Security-Policy
  • Medium No HSTS header
  • Medium Other sites can embed your pages (clickjacking)
  • Low Not rechecked DMARC is monitor-only

+ 4 more lower-severity findings

Real results from a real site, scanned before and after a round of fixes. Its name is hidden.

This is one real site. Your results depend entirely on your site.

Passed means a check found no problem. Fixed means a finding from the first scan that no longer appears. Not rechecked means the check could not run the second time, so we don't call it fixed.

See the full sample report

  • Authorized scans only

    No scan runs until you confirm the site is yours or you have permission to test it.

  • Read-only requests

    Standard scans send only GET, HEAD and OPTIONS. Nothing on your site is changed.

  • Every request on record

    See exactly what we sent, request by request.

  • Secrets kept masked

    We keep a masked fragment as evidence, never the full secret.

144 kinds of problem explained in plain English

What we check

The mistakes that put your users' data at risk

We test your live site from the outside, the way an attacker would, with nothing but its address. So it works with any stack: hand-written code, any framework, a site builder or an AI tool.

  • Library versions are checked against OSV.dev, the open-source vulnerability database.

  • Leaked keys

    Anyone could take over your database

    Secret keys for your database, payments, cloud or AI services, readable in your site's JavaScript. Public keys meant for browsers are recognised and not flagged.

  • Exposed files

    Your secrets can be downloaded

    Environment files, your Git history, database dumps and server code left where anyone can fetch them.

  • CORS and APIs

    Other websites can read your users' data

    APIs that answer any website on your logged-in users' behalf, and error pages that reveal how your server works.

  • HTTPS and cookies

    Logins can be stolen

    Missing or broken HTTPS, old encryption, and session cookies that scripts can read or that travel unencrypted.

  • Headers and CSP

    Your pages can be hijacked

    Missing protections that let other sites frame your pages or let injected scripts run.

  • Outdated libraries

    You're running code with known holes

    The libraries in your app, checked against a public database of known vulnerabilities.

  • Email and domain

    Others could send email as you

    We check SPF, DKIM and DMARC, the settings that decide whether someone can send email pretending to be your domain.

An outside scan can't see everything. A good grade doesn't mean your app is fully secure.

The report

Every finding, explained like a person would

Each problem says who can exploit it, what it means for your users, and exactly what to do, down to the menu you need to open.

  • What it means. The risk in plain words, and who can take advantage of it.
  • How to fix it. Clear steps you can follow yourself or hand to your developer.
  • A prompt for AI coding tools. Using Lovable, Bolt, Cursor or another assistant? Paste it in, then recheck.

CriticalAnyone on the internet

Supabase service_role key is in your website's code

  • Found in /assets/index-4f2a.js eyJhbG…(207 chars)

What it means

The service_role key is the master key of your Supabase project: it ignores every Row-Level Security policy. Anyone can open your site, read this key from the JavaScript, and read, change or delete every row in your database and every file in storage.

How to fix

  1. Rotate the key now: in the Supabase dashboard go to Project Settings → API (or API Keys) and roll the service_role / secret key. The leaked one keeps working until you do.
  2. Remove the key from the frontend code and from any VITE_ / NEXT_PUBLIC_ environment variable.
  3. Move the operations that needed admin rights into a Supabase Edge Function or server route that keeps the key secret.

Fix prompt for AI coding tools

I'm building this app in Lovable. A security scan of my live site https://yoursite.com found a problem I need you to fix. Problem: Supabase service_role key is in your website's code. …

How it works

From address to fixed in three steps

  1. 01

    Confirm it's yours

    Confirm you own the site or have written permission to test it. To unlock deeper scans, prove ownership with a meta tag, a file or a DNS record. Building with AI? We give you the exact prompt.

    <meta name="torvane-verification" content="8f3c…">

  2. 02

    Get your report

    A read-only scan of your live site, grouped by severity, with a grade you can track over time.

    • 1 critical
    • 2 high
    • 4 medium
    • 4 low
    • 7 passed

  3. 03

    Fix and recheck

    Follow the fix steps, or paste the prompt into your AI tool. Redeploy, press Recheck, and see what's fixed, what's left and anything new.

    FixedYour environment file with secrets is public

Safety

Security you can verify

Every scan follows the same rules, enforced in code rather than left to good intentions. Here is exactly what they are.

Read the full safety model

  • Ownership first

    A token issued to you for one site, published as a meta tag, a file or a DNS record. It expires after 7 days and is checked again right before every scan.

  • Read-only, by default

    Every standard scan uses only GET, HEAD and OPTIONS requests. No forms are submitted, no payloads are sent, and redirects are never followed. Logged-in testing exists only for Enterprise customers, under a signed scope agreement.

  • Pinned to your server

    Your site's address is resolved once and pinned for the whole scan. Private, internal and cloud-metadata addresses are refused.

  • Gentle by default

    At most 3 requests a second (up to 10 for a site with an ownership proof), with a fixed request budget per scan.

  • Minimal data kept

    Status codes, sizes and masked evidence. Response bodies never leave memory and are never stored.

  • A full audit trail

    Every request we made, and every action on your account, is logged and visible to you.

Start free. Upgrade when you need more.

One free deep scan with the full report. Upgrade for scheduled scans, alerts and client-ready reports.

Save about 17% yearly

  • Free

    Try it on one site

    $0no card needed

     

    • 1 site, 1 deep scan
    • Full report and fix prompts
    • 3 single-finding rechecks per scan
    Start free scan
  • Coming soon

    Pro

    Solo builders

    $12/ month

    Billed monthly

    • 3 sites
    • Unlimited scans and rechecks*
    • Scheduled scans, at night your time
    • Email alerts for new vulnerabilities
    See Pro

  • Ultra

    Freelancers and agencies

    $29/ month

    Billed monthly

    • 10 sites
    • Everything in Pro
    • Reports with your logo
    • Shareable report links
    • Pick the hour of scheduled scans, and alert your clients
    See Ultra

  • Enterprise

    Teams with logged-in apps

    Custom

    Scoped and quoted for you

    • As many sites as you need
    • Logged-in (authenticated) testing
    • Manual or assisted review
    • Custom scope and limits
    Contact us

Compare all plans Need logged-in testing? See Enterprise

*Fair use applies. Every scan keeps its request cap and is limited to 3 requests a second (up to 10 for a site with an ownership proof).

Questions

Before you scan

Still unsure? Read how we keep scans safe.

Will a scan slow down or break my site?

No. A standard scan only sends GET, HEAD and OPTIONS requests, at most 3 requests a second (up to 10 for a site with an ownership proof), with a fixed budget per scan. Nothing is submitted, created or changed, and we only contact the site you verified, plus the Supabase or Firebase project it uses if you turn that on.

Does it work with my stack?

Yes. We test your live site over the internet, from the outside, so it doesn't matter how it was built: hand-written code, any framework or hosting platform, a site builder or an AI tool.

Why do I have to confirm the site is mine?

Scanning a site without permission can be illegal, so before the first scan you confirm you own it or have written permission to test it. We record that confirmation, cap how often any site can be scanned, and every request we send links to our abuse contact. Proving ownership with a meta tag, file or DNS record unlocks deeper scans.

Do I need security experience?

No. Each finding explains the risk in plain English, with clear steps to fix it that you can follow yourself or pass to your developer. If you build with an AI tool, you also get a prompt to paste in.

What do you keep about my site?

The address, status and size of each request, and masked evidence such as eyJhbG…(207 chars). You can see every request we made. Response bodies are never stored. Full details.

What does it cost?

Free covers one site with one deep scan, and after you fix things you can recheck up to three findings one at a time. Pro adds up to three sites, scheduled scans and email alerts. Ultra adds up to ten sites and client-ready reports. Enterprise is for logged-in testing and custom scope. See the plans and prices.

See where your site stands

Enter your site's address to start. Your first deep scan is free.

Read-only. Won't change or slow your site.

  • 1 free deep scan
  • No credit card
  • Only sites you may test