Response headers
Browser defenses
HSTS, Content Security Policy, framing rules, MIME sniffing, referrer policy, and session-like cookie attributes.
Scan your AI-built site
Built with Lovable, Bolt, v0, Replit, ChatGPT, or your own stack? Paste the URL and see what the browser can reach.
Free to run. No account required.
Public, low-impact requests only.
Evidence and fixes instead of a made-up score.
Run the public scan
Enter the live website address. The scan reads up to five public pages and five same-origin scripts.
Free public tool
Public pages only. No login or exploitation.
Page content is not sent to analytics.
AI code still ships to browsers
AI builders can get a site online quickly. They can also ship a missing header, a public source map, an exposed route, or a secret placed in client code. This scanner checks the public evidence that survives the deploy.
Every finding says what was observed, why it matters, how confident the check is, and what to fix next.
Public bundles
Client-side leaks
High-confidence private-key patterns and production source-map references in public HTML and JavaScript.
Endpoint references
Exposed routes
Same-origin API paths referenced by the public pages and scripts we inspect. We list them without calling them.
Common exposures
Deployment leftovers
A bounded check for public environment files, Git configuration, and server-status output.
A bounded public scan
The stages shown while the scan runs are real server-side work, not a loading animation on a timer.
- 1
Validate
Normalise the URL, resolve its public address, and block private or local network targets.
- 2
Read
Fetch a small set of public pages with strict limits on redirects, time, ports, and response size.
- 3
Inspect
Review response headers, same-origin scripts, endpoint references, secret patterns, and common exposed files.
- 4
Report
Return the observed evidence, confidence, practical fixes, and a clear list of checks we did not perform.
Useful evidence, honest limits
The report names every completed check and every important test left outside the scope. A clean result means the limited scan found no listed issue. It does not certify the website as secure.
Active testing needs written permission
Logins, form submission, fuzzing, exploitation, authorization checks, and business-logic testing belong in a separately scoped review.
See the deeper reviewQuestions before you scan
Is this only for AI-built websites?
No. It works on any publicly reachable website. The AI-built angle matters because fast shipping can make it easy to overlook what ended up in the browser or deployment.
Does the scanner hack or exploit the site?
No. It uses bounded public GET requests. It does not log in, submit forms, brute-force inputs, mutate data, or attempt exploitation.
Does a clean report prove my site is secure?
No. A clean report only means this limited public scan did not observe a listed issue. Authentication, authorization, business logic, and deeper infrastructure testing require an authorised review.
What happens to the page content you inspect?
The scanner processes bounded public responses to build the report. It does not include page content or credential values in analytics, and any matching credential sample is masked.
Scan before you share the link
A few public checks can catch mistakes while they are still easy to fix.