FREE · SAFE PUBLIC SCAN · NO LOGIN


We protect your app.

You shipped fast with AI. Dr. Security runs a safe public scan and tells you what's exposed and exactly how to fix it.

+0
SECURITY CHECKS
Headers, secrets, TLS, DNS, config, and more.
~0s
TIME TO RESULT
Findings and severity, fast.
$0
FREE PREVIEW
See your risk before you pay.
BUILT FOR APPS SHIPPED ONLovable, Bolt, Cursor, v0, Replit, Base44, GitHub, Supabase, Firebase, Framer, Webflow, Figma, Anthropic, Windsurf

HOW IT WORKS

https://your-app.com
STEP 01

Paste your URL

Any public site or app. No account, no code access, no setup required.

API keys & secrets
Security headers
SSL / TLS
STEP 02

We scan, safely

Passive public checks only: no exploits, no fuzzing, no heavy crawling.

A
API KEYS & SECRETS
Key exposed in public bundle
STEP 03

Get a findings report

Prioritized findings, ranked by severity, with copy-paste fixes for your AI tools.

WHAT WE CHECK

01
Your private keys are exposed
API KEYS & SECRETS
Hiding in your app's public code, where anyone can find them.
02
Anyone can read or change your data
DATABASE PERMISSIONS
Your Supabase or Firebase database is set to let anyone in, not just you.
03
Your site is missing basic protections
SECURITY HEADERS
Simple safeguards that stop attackers from hijacking pages or stealing clicks.
04
Your connection security has gaps
SSL / TLS & CORS
Weak encryption settings, or rules that let other sites read your data.
05
Internal files are sitting out in the open
CONFIG & DEBUG FILES
Settings files, backups, or error pages that reveal more than they should.
06
Attackers can see exactly what you're running
TECH FINGERPRINT
The frameworks and tools behind your app, making it easier to target known weak spots.

SEE A REAL REPORT

Every finding shows its severity, redacted evidence, the business impact, and the exact fix. The free preview shows your critical issues, and the full report unlocks the rest.

CRITICALFix immediately: likely exploitable now.
HIGHSerious exposure: fix before you scale.
MEDIUMWorth hardening soon.
report · shipfast.app6 findings
EVIDENCE
SUPABASE_KEY = "eyJhbGci••••••••••••redacted"
WHY IT MATTERS
Anyone can read this key from your public JavaScript and query your database directly.
Rotate the exposed Supabase key, move it server-side, and enable row-level security so the anon key can't read protected tables.
+ 3 more findings with fixesUNLOCK FULL REPORT →

GET YOUR BADGE.

Every scan earns a free embeddable badge. Drop it in your README, landing page, or launch post. It links back to a live, publicly verifiable report, so anyone can confirm it's real.

WHY IT MATTERS

AI builders move fast, and API keys or database credentials often end up sitting in the app's public code where anyone can find them. A visible badge shows users, investors, and collaborators that someone actually checked, instead of just taking your word for it.

WHAT YOUR VISITORS SEE
A
Scanned by
DR. SECURITY
FREE SCAN
Click the badge to see the scan status page explanation

WHO IT'S FOR

AI Builders

Shipped with AI, unsure what leaked

Lovable, Bolt, Cursor, v0. Fast to launch, but easy to leave keys, database rules, and config exposed. Get confidence before you share it.

Technical Founders

Need evidence, not guesswork

A credible external report to share with teammates, customers, and investors, with prioritized findings and remediation you can track.

Teams

Continuous public exposure watch

Scheduled scans, alerts, and history across multiple assets, so a risky change never ships unnoticed.

WHY US, NOT A TRADITIONAL SCANNER

Dr. Security
Traditional scanners
Built for AI-built & vibe-coded apps
Yes
—
Plain-language findings, no jargon
Yes
Often not
Copy-paste AI fix prompts
Yes
—
One-time report, no subscription
$1
Usually not
Free public preview in ~60s
Yes
Limited
Safe, passive-by-default scanning
Yes
Varies

COMPARE PLANS

FREE PREVIEW
$0(Free)
LAUNCH REPORT
$1(One-time payment)
$1/mo
FOUNDER MONITOR
$149/mo
$1,490/yr

Debug and backup endpoints

Checks a small allowlist of debug and backup paths (.git/HEAD, .DS_Store, phpinfo.php, server-status, actuator/env, backup.sql), each confirmed by its content, for public exposure.

Debug and backup endpoints

Deprecated TLS versions

Attempts a TLS 1.0 and a TLS 1.1 handshake and flags a server that still accepts either.

Deprecated TLS versions

DNS records

Inspects public DNS records for the submitted domain.

DNS records

Exposed source maps

Follows the source map references in the site's JavaScript bundles and confirms whether the original source code is publicly downloadable.

Exposed source maps

HTTP security headers

Checks the homepage response for CSP, HSTS, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy, and cookie flags.

HTTP security headers

HTTPS & certificate health

Checks the HTTP-to-HTTPS redirect and the TLS certificate's validity, hostname match, and expiry.

HTTPS & certificate health

Mixed content and insecure forms

Parses the homepage for scripts, frames and form actions loaded over http:// on an HTTPS page.

Mixed content and insecure forms

Public file exposure

Checks a small allowlist of sensitive paths (.env, .git/config, OpenAPI/Swagger docs) for genuine public exposure.

Public file exposure

Cross-origin (CORS) policy

Sends one request with a foreign Origin header and flags a server that reflects it, or the null origin, while allowing credentials. Runs only after ownership of the domain is verified.

Cross-origin (CORS) policy
—

Leaked secrets

Looks for credentials publicly leaked for the submitted domain.

Leaked secrets
—

Ownership verification

Checks whether the customer has proven ownership of this asset via DNS TXT record, meta tag, or file upload.

Ownership verification
—
—

SAFE BY DEFAULT

WE ONLY RUN
HTTP security headers & TLS / certificate metadata
DNS, robots & sitemap metadata
Public JavaScript & asset inspection
Safe HEAD/GET on obvious public files
Technology fingerprinting
WE NEVER
Exploit attempts or destructive tests
Form fuzzing or credential testing
Authenticated or internal scans without consent
High-volume crawling
Anything that could degrade availability

FAQ

Is scanning my site safe?
Yes. The free scan is passive and public-only. No exploit attempts, no fuzzing, no authenticated access, and nothing that could degrade your site.
Do I need to give you code access?
No. A free scan needs only a public URL. Deeper checks like repository scanning require you to verify ownership and grant explicit access first.
What do I get for free?
Your critical findings with severity and business impact, redacted evidence, and one basic fix per issue. Upgrade for the full report and fix prompts.
How fast are results?
Most public scans finish in about a minute. You'll see progress as checks complete, then a findings report you can act on right away.

FIND OUT WHAT YOU'RE EXPOSING.