Guide
A security scanner for your website
A website security scanner reads what your site sends to the browser and reports the holes, such as exposed keys, an open database, and missing security headers. For AI-built and vibe-coded sites, a passive scanner that checks from the outside catches the exact defaults those tools leave open, with no install and no access to your code.
What a scanner checks
- Exposed keys in the shipped JavaScript, like Supabase or Firebase keys and secret payment or cloud credentials.
- Database exposure, whether tables can be read without a login.
- Security headers, cross-origin policy, and TLS.
- Leaked internals, like published source maps, a public .env, disclosed server versions, and browsable directories.
Passive scanning, and why it fits AI-built apps
A passive scanner reads only what the browser already receives: the HTML, the JavaScript, the response headers, and the TLS handshake. It does not attack your site or query your database without permission. That is the right tool for a vibe-coded app, because the mistakes AI builders leave, exposed keys and open data, are all visible from the outside.
It does not attack your site or query your database without permission.
How to run one
Paste your live URL into Plaintext. It reads your site the way an attacker would and reports what is open, worst first, with the exact fix for each. The first scan is free and needs no setup.
Frequently asked
What does a website security scanner do?
It reads what your website exposes and reports the security holes: exposed keys, an open database, missing headers, leaked source. A passive scanner does this from your public URL without attacking the site or needing your code.
How do I scan my website for security issues?
Paste your live URL into a passive scanner like Plaintext. It reads the shipped JavaScript, the endpoints, and the headers and lists the issues worst first, each with a fix. No install or login is needed.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes AI code generators leave open. The first scan is free.
Scan my app