SecScan is an automated black-box security scanner for web applications. You paste a URL for an app you own or are authorised to test and receive a plain-English security report, usually within ten minutes. No installs, agents or code changes required. It is an automated scanner rather than a manual penetration test, and it is free during early access.

What security checks does SecScan perform?

SecScan checks security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy), SSL/TLS configuration and grade, cookie flags (HttpOnly, Secure, SameSite), CORS misconfigurations, server version disclosure, technology fingerprinting, exposed secrets and sensitive files, known-CVE component versions, and Supabase/Firebase data exposure — aligned with the OWASP Top 10 categories that are testable from outside the app (it does not perform authenticated or server-side testing, so categories like A04, A09 and A10 are out of scope).

How long does a SecScan scan take?

Most scans complete in under 10 minutes. Basic scans typically finish in 1–2 minutes. Deep scans with AI analysis usually complete in 3–10 minutes depending on the target site.

Is SecScan safe? Will it harm my app?

SecScan sends real probe traffic, so scan only applications you own or are authorised to test. A scan includes a TCP connect scan of common ports, subdomain enumeration, and active probing with injection, cross-site scripting and path traversal payloads against parameters it discovers. When an exposed Supabase or Firebase backend is found it sends a single bounded write probe using a synthetic field name that cannot exist in a real schema, and immediately deletes any row it creates. It never sends destructive requests against your data (no PATCH or DELETE of existing records), never brute-forces credentials, never attempts to gain persistence, and refuses targets that resolve to private or internal addresses.

What does a scan include?

Every scan is a full scan and there are no tiers. It covers security headers, TLS, cookies and CORS, technology fingerprinting and known-CVE matching, JavaScript secret scanning, injection and path traversal probing, API surface discovery and testing, access control comparison between two accounts, Supabase and Firebase rules, reconnaissance including open ports and subdomains, DeepSeek AI analysis, and per-agent fix prompts for Cursor, Claude Code, Lovable, Bolt and Replit AI.

What does the per-agent fix prompt do?

After a Deep Scan, SecScan generates a ready-to-paste prompt for your specific AI coding tool. Each prompt is pre-formatted with the vulnerability context and the exact fix instructions so you can paste it directly into Cursor, Claude Code, Lovable, Bolt, or Replit AI and get working code.

Does SecScan work on sites not built by AI?

Yes. SecScan scans any publicly accessible web application — whether it was built by AI tools, hand-coded, or made with no-code platforms. The scan targets the live HTTP responses, not the source code.

What is a Monitor subscription?

The Monitor plan ($49/month) runs automated deep rescans of your site every week and checks a daily CVE (Common Vulnerabilities and Exposures) feed to alert you when newly disclosed vulnerabilities match technologies detected in your stack.

New scan — SecScan

SecScan — black-box security scanningSecScan needs JavaScript to run a scan. These pages read fine without it:

Home
Security documentation — every check explained
Privacy policy
Terms of service