See what your site tells a stranger.
Enter a URL and we will look at it the way a visitor's browser does: one request for the page, then the scripts it loads. No signup, no agent to install, and nothing your own browser would not already have fetched.
What we look at, and what we will not do
Secrets in your code
The scripts your page loads, read for database keys, payment keys, model API keys and connection strings that should never leave your server.
Connection
HTTPS, whether http visitors get redirected, and how long browsers are told to remember it.
Response headers
The content policy, framing protection, referrer leakage, and what your server announces about itself.
Cookies
Whether a session cookie can travel unencrypted, be read by scripts, or be sent from another site.
Page and client code
Insecure resources, forms and WebSockets, third-party script integrity, stack traces, and source maps left in production.
This is a passive scan
We request the page and the scripts it references, and nothing else. We do not guess at hidden paths, submit forms, try credentials, or send anything designed to break the site. Our requests identify themselves as VibeZero-Scanner in your access log. We will not scan a private or internal address, and you should only scan sites you own or are authorized to test.
What you built it with
We name the builder, the framework, the database and the auth provider we can see from outside, because half the answers on this page depend on the stack. Some checks only exist for some of them: we only ask whether a development server is exposed once we can see one was possible. It is information, not a finding. Nothing on this list costs you a point.