Free emailed mini check
Is your app exposed? Find out for free.
Send your app's URL. We run a passive, non-invasive check of what your app already makes public: its JavaScript bundle (looking for exposed keys and secrets), its security headers, and any public storage links. You get a 1-page traffic-light summary by email within 24 hours.
For app owners, or someone the owner has authorized. You also need to consent to the check. We never scan or publicly name apps without the owner's permission. An emailed mini check is passive. It makes no database queries and no logins, and it is not a full audit. Live database and Row Level Security testing happen only in a paid engagement, after you sign the consent in the intake form.
Proof of ownership. If the check finds an exposed secret key, we share the details only after you verify that you own the site: we send you a one-time code to publish on the site or in its DNS. An email from your domain doesn't count as proof.
Thanks, we got your request. We'll run a passive check of what your app already makes public and email you a one-page summary within 24 hours.
If the check finds an exposed secret key, we'll first ask you to verify that you own the site with a one-time code, and share the details only after that.
Your reference: