Your website's checkup, for one dollar.
We run the tests any visitor's browser could, flag what's out of range, and explain each fix in plain English for the platform your site runs on.
| Test | Result | Flag |
|---|---|---|
| Hidden until unlockedExposed | Exposed | Critical |
| Hidden until unlockedNo redirect | No redirect | High |
| Hidden until unlockedMissing | Missing | Medium |
| Hidden until unlockedToo open | Too open | Medium |
| CertificateExpires in 61 days | Expires in 61 days | Normal |
| Email sender list (SPF)Present | Present | Normal |
Flagged rows open up with the $1 report, each with a fix written for your platform.
What the checkup tests
Eight groups of tests, about forty checks in all. Each one only reads what your site already shows the world, the same way a browser does when someone visits.
- Is the connection encrypted?HTTPS, the redirect from http://, certificate dates, outdated encryption.
- Do browsers get safety instructions?The headers that stop clickjacking, script injection and file-type tricks.
- Are login cookies protected?Secure, HttpOnly and SameSite flags on the cookies your site sets.
- Are private files sitting in public?Settings files (.env), source history (.git) and diagnostic pages.
- Is any software out of date?Old JavaScript libraries, WordPress and PHP versions with known holes.
- Can scammers send email as you?SPF, DKIM and DMARC records on your domain.
- Does the page load anything insecurely?Scripts, images or forms that go over plain http://.
- Can people report problems to you?A security.txt file with a contact address.
What each checkup includes
Start free. Pay only for the part you need, once, with no account.
Checkup
Free- About forty tests on your live site, no account
- How many results are flagged, and how serious
- Safe to run on any site: we only look
Report
$1 once- The 3 to 5 results that matter most, ranked
- Straight answers: can your email be faked, are private files public?
- Everything else we noticed, listed below them
- Each one explained in plain English
- Copy-paste fixes for your platform, merged so you paste once
- Free re-checks for 30 days to confirm each fix worked
- A private link you can forward or print
Deep review
$9 once- Every finding written up, not just the top five
- Forgotten subdomains, from public certificate records
- Keys, secrets and source code left in your site's JavaScript
- Still just your web address: no login, no code
Available now. Start a deep review, or choose it after your free checkup.
Code review
$29, your $1 credited- We read your app's code, not just its pages
- Leaked keys, missing logins, open database rules, unchecked payments
- Each problem with the file, the line and the fix
- Read-only: we never run or change your code
Available now. Start a code review: upload a .zip or point us at a public GitHub repo.
Monitoring
$5/month or $48/year- A fresh checkup every week
- Every finding, not just the top five
- An email when something new appears or gets worse
- A warning before your certificate expires
Available now. Start monitoring.
What a deep review finds
We ran a deep review on a real fantasy-sports contest site, from the outside only: just its web address, no login and no code. We removed the names; the owner has the full report.
The $1 report saw four small things. The deep review read everything the site hands to visitors, and found its source code published and member IDs in a public feed.
| Test | Result | Flag |
|---|---|---|
| Does a public feed list member IDs?Yes, 21 of them | Yes, 21 of them | Medium |
| Can anyone read the site's source code?Yes, it's published | Yes, it's published | Medium |
| Is injected script blocked?No policy set | No policy set | Medium |
| Which websites can read the site's data?Any website | Any website | Low |
| Are keys or secrets in the JavaScript?None found | None found | Normal |
| Any forgotten subdomains?None found | None found | Normal |
The $1 report on this site flags 4 minor results. The deep review found 7, including the clue the code review then confirmed.
What a code review finds
Then we reviewed the same app's code. It was built with Cursor, an AI coding tool. We removed the names and file details; the owner has the full report.
None of these show up from the outside. The problems live in the code, so the code review reads the code itself.
| Test | Result | Flag |
|---|---|---|
| Who can make an account an admin?Anyone signing up | Anyone signing up | Critical |
| Who can edit a contest?Anyone, no login checked | Anyone, no login checked | Critical |
| Who can pick in the live draft?Whoever claims the turn | Whoever claims the turn | Critical |
| Who can change a member's profile?Any logged-in member | Any logged-in member | High |
| Are passwords kept out of the logs?Logged in plain text | Logged in plain text | High |
| How are passwords stored?Hashed (bcrypt) | Hashed (bcrypt) | Normal |
In the full review, each flagged row opens into a note with the file, the line and the fix.
Safe to run on any site
It's a passive checkup. We look; we don't poke. That's why there's no sign-up and no need to prove you own the site first.
- login attempts or password guessing
- forms submitted, nothing written to your site
- attack payloads or vulnerability probing
- secret values kept: if we find an exposed settings file we record its key names only