Guide
How to scan your website for vulnerabilities
To scan your website for vulnerabilities, run a passive scanner against your live URL: it reads the shipped HTML, JavaScript, and headers and flags exposed keys, open databases, missing headers, and leaked source. Paste the URL, read the report worst first, and fix each issue with the steps it gives you.
The steps
- Paste your live URL into a passive scanner. Use the real deployed address, since that is what an attacker sees.
- Read the report worst first. Critical issues, like an exposed secret key or an open database, come at the top.
- Fix each with the provided steps or fix prompt, then scan again to confirm it is closed.
What a scan finds
A passive scan surfaces the openings that live in what your site sends to the browser: keys that should have stayed on the server, databases readable without a login, absent security headers, a permissive cross-origin policy, and leaked source or config. For an AI-built site, that is most of the risk.
Use the real deployed address, since that is what an attacker sees.
What a scan cannot confirm
A passive scan cannot verify that your database access rules are correct without querying the database, which requires that you own or have permission to test the target. So it reports a suspected open database as suspected, not proven, unless ownership is verified. Run a scan on Plaintext and read exactly what it did and did not test.
Frequently asked
How do I scan my website for vulnerabilities?
Run a passive scanner against your live URL. It reads the page, the JavaScript, and the headers and reports vulnerabilities like exposed keys, open databases, and missing protections, worst first, each with a fix.
What can a website vulnerability scan find?
A passive scan finds exposed API keys, databases readable without a login, missing security headers, a wildcard cross-origin policy, and leaked source or config. It reads only what the browser already receives, so it needs no access to your code.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes AI code generators leave open. The first scan is free.
Scan my app