Founder

Scan your app

Paste the address of an app you own. We look for leaked keys, public source maps, open databases and missing cookie flags, without signing in or writing anything.

The full address, like https://example.com

What we check

  • Secrets in served filesAPI keys or tokens inside the JavaScript and HTML your app sends to browsers.LC-04
  • Database not publicA database port that answers from the internet.LC-05
  • Cookie flagsSession cookies without Secure, HttpOnly and SameSite.LC-12
  • Public source mapsMap files that hand your source code to anyone who asks.

Active checks run only after you prove you own the app with a DNS record.