Pre-launch check
Paste a public URL. We fetch the page and same-origin JS (capped), then report security headers, secret-looking strings, exposed /.env / /.git, source maps, and basic SEO. Nothing is stored.
What this covers
- CSP, HSTS, framing controls, nosniff, Referrer-Policy, HTTPS redirect
- Secret patterns in HTML/JS (Stripe, OpenAI-style, Anthropic, AWS, GitHub, private keys, Supabase service_role) — shown masked
- Supabase anon/publishable key and project URL noted as info (check RLS)
- Public
/.env,/.git/config, source maps, mixed content (http:// resources on an https page) - robots.txt, sitemap.xml, meta description, Open Graph, favicon
SSRF-safe: only public http(s) hosts, DNS checked for private/metadata IPs, redirect and size caps, rate limited. Not a penetration test.
The checker covers ~12 of 100 launch checks. Get the full kit · free checklist preview · guides
Get launch notes
$ subscribe --launch-notes # new checks, prompts and shipping tips for vibe coders. No spam.