Paste the address
Use the public address of a site you already deployed. A local practice site is fine too.
Free to try
A gentle check for the app you built
Paste the address of a site you own. We read the public pages and tell you, in plain language, if a key, a file, or a database setting is sitting where anyone can see it.
Made for nonprofit teams who built an app with an app builder and want a calm look before more people rely on it.
Your plan
Free, or Safety Scanner Plus
Free includes 3 checks every 30 days, on the public page and a little of its code. Safety Scanner Plus includes the fix steps, a short list of private files, the database check, and 40 checks in that same window. The Bundle is a separate checkout.
Checking your sign-in…
Monthly, yearly, and Bundle checkout links are not set on this server yet.
How it works
Three quiet steps
Say you have permission
The check only runs after you confirm you own the site, or someone asked you to look.
Read the report
A traffic light, then the findings that matter first, each with a why and a fix you can copy.
What we look for
Only what a visitor can already open
Keys in the public code
An app builder can leave a key in the browser code while you are still building. We look for those patterns and mask whatever we find.
Database settings
Supabase and Firebase configs are often public on purpose. We use only the public key already on the page, and we peek once to see if a table answers without a sign-in.
Safety headers and HTTPS
Content-Security-Policy, HSTS, framing, the certificate, and whether the plain address sends people to the locked one.
Files that should stay private
A short list: .env, .git/config, and source maps linked from the page. Plus pages that mix a secure address with a plain one.
Honest limits
What this check will not do
It does not attack
No password guessing, no fuzzing, no extra paths beyond a short fixed list. It does not change your site.
It does not keep secrets
Keys are masked in the report and then forgotten. We do not store the scan.
It does not see private pages
If a visitor would need to sign in, this check cannot see it either. A green light is a first look, not a full review.
It stays gentle
There is a limit on how often a check can run, and a cap on how many pages one check will open.