Security crash-test
Your app has a weak spot. Better you find it first.
Connect a repo. In about a minute you'll know what an attacker could reach, and the exact change that closes it.
Score
Two things to close before anyone else looks. One check had no evidence to read.
- Critical
Live payment key in git history
STRIPE_SECRET_KEY · committed 4 months ago, deleted since
- High
Admin route with no role check
/api/admin/* · anyone signed in can reach it
- Clean
Borrowed code
41 packages · checked against the OSV database
- No evidence
Who can read your database
No migration files in the repo, so the rules were never read
How we report
A check we couldn't run is not a check you passed.
A green tick can mean “we looked and it's fine” or “we never looked”. You can't tell which one you got. So we report three answers instead of two.
- Checked, nothing found
- There was something to read, we read it, and it came back clean. The only kind of pass we will show you.
- Found a problem
- We show you the file, the line, and what it would let someone do to you.
- Could not check
- The evidence wasn't in your repo. We say so, and show you how to check it yourself.
Our scores read lower than tools that round an unchecked item up to a pass. We would rather be the report you can act on.
3
States, not two
Pass, fail, and could not check. Always reported separately.
500
Commits deep
Deep enough to find the key you deleted six months ago.
~60
Seconds, typical
Five passes over a normal repo, start to finished report.
What we check
Five passes over your repo, in this order.
Your code is cloned into a locked box and the network is cut before anything runs. It never leaves, and the box is destroyed when the scan ends.
- 01
Things you never meant to publish
Every key, token and password you ever committed — including the ones you deleted afterwards. Git keeps them, and so does anyone who cloned you.
500 commits deep · finds keys deleted months ago
- 02
Doors left unlocked
Pages that should sit behind a login and don't. Data one signed-in user can read that belongs to another.
Rules we wrote ourselves, tuned for Next.js
- 03
Borrowed code with known problems
Every package you installed, checked against the public record of known holes in them.
Offline, against a database shipped inside the scan
- 04
The parts that aren't code
Where your uploads live, who can read your database, whether your storage is open to the world. This is the part other scanners skip, and it is where vibe-coded apps leak.
The checks nobody else is writing
- 05
Then it gets explained
Only now does a model get involved, and only over what the four passes above already found. It groups duplicates, ranks by what an attacker could do, and writes it in plain English.
Same ranking on every plan, free included
The report
A finding you can act on without looking anything up.
Every finding answers the same four questions, in the same order. No jargon, and no severity number you need a degree to read.
Live payment key in git history
Critical- What it is
- Your live Stripe key is in the repo's history. You deleted it later; git kept the original.
- What someone could do
- Anyone who has cloned this repo can charge cards, issue refunds and read your customer list. It works right now.
- Where it lives
- Added in a3f9c21 four months ago, removed in 8b21e4d. Still in history, still valid.
- How to close it
- Rotate the key first — that kills the old one instantly. Then move it into an environment variable. On Pro we open the branch that does the second part.
When to run it
Three moments where this earns its keep.
Same scan every time. What changes is what you do with the answer.
Pricing
Free finds it. Pro fixes it.
Free gets you the whole scan and every serious finding. Pro writes the fix, on a branch you review first.
Critical and high findings are never behind the paywall. Find something serious on a free account and you see all of it.
Find out where you stand.
Read-only access to one repo. Revoke it whenever you like.