Startup Security Check — 19 Points, 15 Seconds
Most startup security incidents are preventable. Leaked API keys, exposed .env files, missing security headers — these are detectable in seconds with a passive scan. Run one before you find out the hard way.
What happens when these issues are exploited
Leaked Stripe key
Attacker creates refunds, modifies subscriptions, or charges arbitrary amounts to your account.
Exposed Supabase service role key
Full read/write/delete access to your entire database — all user data, all tables.
Exposed .env file
All secrets in one file — database URL, API keys, JWT secrets — served publicly at /.env.
Missing CSP header
XSS vulnerabilities can inject scripts on your pages — stealing sessions, redirecting users.
Missing HSTS header
SSL stripping attacks can downgrade HTTPS to HTTP on repeat visits.
CORS wildcard on API
Any website can make authenticated requests to your API using a user's browser session.
Source maps in production
Exposes original source code — including comments, internal logic, and any inline secrets.
What you get from the scan
Questions
Why should startups run a security check early?
Early-stage startups are frequently targeted because attackers assume security wasn't a priority. A leaked Stripe key or exposed Supabase service role key can drain your payment account, wipe your database, or expose all user data. Catching a leaked key before you have 10,000 users is trivially easy to fix; catching it after a public breach is a company-ending event.
Is this scan safe to run on a production site?
Yes — completely passive and read-only. It makes the same GET requests a browser makes. No login attempts, fuzzing, form submissions, or anything that could affect your site. It checks what is already publicly visible.
What's the most common security issue found in startups?
Missing security headers (CSP, HSTS) are by far the most common — missing on ~78% of scanned startup sites. API key leaks in JavaScript bundles are the most severe, affecting ~23% of recently launched apps, especially those built with AI coding tools.
Run your startup security check
Free. No signup. 19 checks in 15 seconds. Security Grade (A-F) instantly.
Run free security scan