A URL is enough to start.
No agent, no proxy, nothing installed. The scan reaches your app the way a visitor does - then walks it in a real browser and records every request the page makes.
25 stages, in order.
Each stage does one thing and writes down what it saw. A stage that cannot run says so and the report records it as skipped, which is why a partial scan can never read as a clean one.
- Deterministic
The same input produces the same finding, with the rule id printed on it.
- Bounded
Every stage has a time and work budget. A slow target cannot hold the queue.
- Streamed
Progress arrives over server-sent events while it runs, step by step.
- Recorded
Coverage lists steps completed, failed and skipped, with notes.
- 01Reaching the siteDISCOVERY
- 02Checking HTTPSTLS
- 03Detecting the stackTECHNOLOGY_DETECTION
- 04Inspecting security headersHEADERS
- 05Checking cookiesCOOKIES
- 06Reading DNS and mail recordsDNS
- 07Reading the page head and structureHTML_DOCUMENT
- 08Reading robots.txt, sitemaps and security.txtWELL_KNOWN
- 09Checking methods and compressionHTTP_BEHAVIOR
- 10Testing how missing pages are answeredERROR_PAGES
- 11Testing cross-origin rulesCORS
- 12Scanning JavaScript for secretsJAVASCRIPT
- 13Probing exposed filesPUBLIC_FILES
- 14Watching the site in a real browserBROWSER_RUNTIME
- 15Measuring the loadPERFORMANCE
- 16Matching advisoriesADVISORIES
- 17Classifying the changeCHANGE_CLASSIFICATION
- 18Reading the diff for secretsSOURCE_SECRETS
- 19Resolving lockfilesDEPENDENCIES
- 20Tracking input through the codeSOURCE_ANALYSIS
- 21Walking git historySOURCE_HISTORY
- 22Reading source no rule coversSOURCE_AI_REVIEW
- 23Correlating findingsCORRELATION
- 24Scoring riskRISK_SCORING
- 25Preparing your reportREPORT
Everything an anonymous visitor can reach.
HTTPS availability, certificate validity and expiry, the HTTP to HTTPS redirect, HSTS, and mixed content on a page that claims to be secure.
Content-Security-Policy quality rather than presence, clickjacking protection, MIME sniffing, referrer policy, Permissions-Policy, COOP, CORP, and version disclosure.
Session cookies without Secure, HttpOnly or SameSite, and cross-origin rules that reflect any origin while allowing credentials.
Sixteen credential patterns across your bundles, published source maps, and keys that were never meant to leave the server.
The .env file, the .git directory, backups, dumps and developer tooling that shipped with the deploy.
A read-only probe replays a request your own page already made, using the public key your own page ships, to prove whether the data is world-readable.
A real Chromium, on your routes.
Headers tell you what a server promises. A browser tells you what your application actually does - which is where the interesting problems live.
- Routes, discovered and clustered
The crawler finds routes, groups the ones that are the same page with different data, and records each one cold and again through client navigation.
- Every request, attributed
Duplicates, N+1 patterns, request storms, third-party weight, render-blocking scripts, uncached assets and oversized images.
- How fast it actually is
Core Web Vitals as the page reported them, the longest main-thread task, page weight and the requests behind it - measured on the free scan, not just the paid one.
- Baselines and regressions
Load, DOM-ready and time-to-first-byte per route are remembered, so “slower than before” is a measurement rather than a feeling.
- What breaks in the open
JavaScript errors, failed requests, insecure form actions, WebSockets without TLS and reconnect loops.
The same bug, reported once.
When the repository is connected, a runtime observation and the line of code behind it become one finding. The code finding is canonical because that is what you change; the runtime observation rides along as proof that it is real in production.
200 · 148 items · no auth header
The browser pass proves the data comes back without a session.
export async function GET(req) {
Taint analysis proves the route has no guard before the query.
One finding, two proofs: the line that is missing the guard, and the response that proves it is missing in production.
What one URL is enough for. Nothing installed.
A header checker reads the home page once. This reads the DNS, the mail records, the files the site publishes about itself, how it answers a page that does not exist, and what a real browser sees - then says, beside each thing, what it means and how to change it.
- Security54 rules
TLS, headers, cookies, CORS, secrets in public JavaScript, source maps, exposed files, a debug page on the 404, tokens in web storage.
- Domain & DNS7 rules
A, AAAA and the CNAME chain, a dangling alias at a hosting provider, CAA against the certificate, www and apex, SPF, DMARC, MTA-STS, TLS-RPT, BIMI, DKIM.
- SEO & indexing10 rules
noindex, robots.txt, sitemaps, canonical, title and description, structured data, the social image, and every crawled page's outline.
- AI discoverabilityrecorded
What robots.txt says to seventeen AI crawlers - search and training, separately - and whether llms.txt exists. Recorded and explained, never an issue: it is your call.
- App health12 rules
How missing pages, API routes and assets are answered, redirect loops, cached server errors, broken links, chunks that failed to load, a page that rendered blank.
- Accessibility4 rules
Images without alt, controls without labels, buttons and links without a name, duplicate ids that break labels, landmarks, skip link, the heading outline.
- Privacy5 rules
Trackers and session replay on first load, personal data leaving for third parties, the page URL shared with trackers, a consent platform or none.
- Performance10 rules
Core Web Vitals from a real load, page weight, oversized images, render-blocking scripts, uncached assets, uncompressed HTML.
- Cost & waste6 rules
Duplicate requests, N+1 patterns, request storms, WebSocket chatter and reconnect loops, third-party weight, an SDK loaded twice.
- Technology2 rules
What the site is built from, matched against advisories and end-of-life dates, and what changed since the last scan.
All 249 rules. Printed, not promised.
Every rule carries the id you see here onto the finding it raises, so you can always tell which check fired and why. Nothing in this list needs AI to run, and 110 of them run on the free scan - a URL and an email, no account, no card, no repository.
What an anonymous visitor can reach. No account, no agent, nothing installed.
- HTTPS is not availablefreeruntime.transport.https-unavailable
- HTTP is not redirected to HTTPSfreeruntime.transport.http-not-redirected
- Certificate is invalidfreeruntime.transport.certificate-invalid
- Certificate expires soonfreeruntime.transport.certificate-expiring
- HTTPS page loads HTTP resourcesfreeruntime.transport.mixed-content
- Content-Security-Policy missing or unsafefreeruntime.headers.csp-missing-or-unsafe
- HSTS missing or too weakfreeruntime.headers.hsts-missing-or-weak
- Page can be framed by anyonefreeruntime.headers.clickjacking-unprotected
- MIME sniffing is not disabledfreeruntime.headers.x-content-type-options-missing
- Referrer policy leaks URLsfreeruntime.headers.referrer-policy-missing
- Permissions-Policy not setfreeruntime.headers.permissions-policy-missing
- COOP missingfreeruntime.headers.cross-origin-opener-policy-missing
- CORP missingfreeruntime.headers.cross-origin-resource-policy-missing
- Server version disclosedfreeruntime.headers.server-version-disclosure
- Session cookie without Secure / HttpOnly / SameSitefreeruntime.cookies.sensitive-cookie-unprotected
- CORS reflects any origin with credentialsfreeruntime.cors.dangerous-origin-policy
- Credential shipped in public JavaScriptfreeruntime.javascript.credential-exposed
- Source maps publishedfreeruntime.javascript.source-map-exposed
- Software in use no longer receives security updatesfreeruntime.technology.end-of-life
- A library the page loads has a published vulnerabilityfreeruntime.technology.known-vulnerable-version
- Exposed .env, .git, backups, dev toolsfreeruntime.exposure.sensitive-path-public
- Data backend reachable from the browserfreeruntime.exposure.browser-data-backend
- CDN code loads without an integrity hashfreeruntime.html.subresource-integrity-missing
- Production page points at a dev hostfreeruntime.html.internal-host-referenced
- Embedded frame granted camera, mic or locationfreeruntime.html.iframe-delegates-device-access
- A form submits to another companyfreeruntime.html.form-posts-cross-origin
- CSP only in markup, not in the responsefreeruntime.html.csp-only-in-meta
- Session cookie without a __Host- namefreeruntime.cookies.missing-host-prefix
- Session cookie shared with every subdomainfreeruntime.cookies.scope-too-broad
- Session cookie valid for over a yearfreeruntime.cookies.session-lifetime-excessive
- CSP only reports, never blocksfreeruntime.headers.csp-report-only-only
- CSP leaves base-uri and form-action openfreeruntime.headers.csp-missing-injection-guards
- CORS response cacheable for the wrong sitefreeruntime.headers.cors-vary-origin-missing
- DNS name points at a host nobody ownsfreeruntime.dns.dangling-cname
- CAA record forbids the current certificate issuerfreeruntime.dns.caa-excludes-issuer
- www and bare domain do not lead to the same sitefreeruntime.dns.www-apex-inconsistent
- Mail domain has no SPF recordfreeruntime.email.spf-missing
- SPF record is invalid or lets anyone sendfreeruntime.email.spf-invalid
- Mail domain has no DMARC policyfreeruntime.email.dmarc-missing
- DMARC policy only monitorsfreeruntime.email.dmarc-not-enforced
- robots.txt blocks every crawlerfreeruntime.seo.robots-blocks-everything
- Home page is marked noindexfreeruntime.seo.page-marked-noindex
- Canonical URL points somewhere wrongfreeruntime.seo.canonical-broken
- Sitemap does not match the sitefreeruntime.seo.sitemap-broken
- Home page has no title or descriptionfreeruntime.seo.title-or-description-missing
- Structured data does not validatefreeruntime.seo.structured-data-invalid
- Social preview image does not loadfreeruntime.seo.social-preview-broken
- Doctype, lang, charset or viewport missingfreeruntime.html.document-basics-missing
- security.txt expired or has no contactfreeruntime.wellknown.security-txt-stale
- Server answers TRACEfreeruntime.http.trace-enabled
- Error page shows a stack trace or debuggerfreeruntime.http.error-page-leaks-internals
- Missing pages answer 200freeruntime.http.soft-404
- Missing pages redirect to the home pagefreeruntime.http.missing-page-redirects-home
- Redirect loopfreeruntime.http.redirect-loop
- Unknown API route answered with HTML or the app shellfreeruntime.http.api-unknown-route-misbehaves
- Missing JavaScript files return an HTML pagefreeruntime.http.missing-asset-returns-html
- Server errors are cacheablefreeruntime.http.error-response-cached
- Home page links to missing pagesfreeruntime.http.broken-internal-links
- HTML served uncompressedfreeruntime.http.html-not-compressed
- Page with a session cookie is publicly cacheablefreeruntime.caching.personalized-response-cacheable
- Payment provider wired in test modefreeruntime.environment.test-mode-payment-configuration
- Placeholder or default page contentfreeruntime.environment.placeholder-content
Point it at something you shipped this week.
A URL, an email, a few minutes. If nothing is wrong, the report says so in one line.