Coverage

What We Scan For

Every plan includes standard scans of your live app. Pro also adds weekly deep scans. Browse the full list of checks

150+ checks ยท 8 categories
01

Vulnerabilities

08 checks
SQL InjectionIDOR & Broken Access ControlXSS Sinks & DOM InjectionGraphQL IntrospectiontRPC Endpoint ProbingAPI Data ExposureJWT WeaknessVulnerable Dependencies (CVEs)
02

Database & Auth

07 checks
Supabase RLS TestingFirebase RulesConvex / MongoDB / Postgres ExposureAuth Endpoint SecurityPassword PolicyRate LimitingPrisma & Drizzle ORM Misconfig
03

Secrets & Exposed Code

04 checks
API Keys in JS Bundles (150+ patterns)Payment Secrets (Stripe, Paddle, LemonSqueezy)Exposed .env / .gitSource Map Exposure
04

Configuration & Headers

05 checks
Security Headers (CSP / HSTS / X-Frame-Options)SSL/TLS & Mixed ContentCORS MisconfigurationCSRF & Form SecurityDebug Mode & WebSocket Security
05

Infrastructure & Platform

07 checks
Platform FingerprintingFull-App Crawl (URLs, forms, APIs)AI/LLM & MCP SecurityNetlify Functions & IdentityBubble.io Data APIEmail Security (SPF / DMARC)Breach Monitoring (HIBP)
06

SEO & AEO

02 checks
SEO Health (meta, canonical, sitemap)AEO/GEO AI visibility (llms.txt, AI crawler rules, JSON-LD)
07

Accessibility & Compliance

03 checks
WCAG AccessibilityLegal Compliance (privacy, ToS, cookie consent)security.txt (RFC 9116)
08

Performance

04 checks
TTFB & Server ResponseCompression & CachingRender-Blocking ResourcesOversized Images & DOM