Free Website Vulnerability Scanner
Is my website vulnerable?
Most of what goes wrong on a live site is visible from outside it - a secret in the bundle, a header that was never set, a database answering the public internet, a certificate about to expire. This website vulnerability scanner runs the whole public check set against your URL in one pass and grades what it finds.
Vulnerabilities this scanner checks for
Exposed keys and secrets
Downloads your JavaScript bundles and matches them against key patterns for 30+ providers, from Stripe and OpenAI to AWS and Supabase.
Read more →Browser security headers
Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy, plus version-disclosing headers you should drop.
Database and storage exposure
Tests what your Supabase project or Firebase Realtime Database returns to a request carrying only the public key in your bundle, and whether storage buckets list publicly.
Read more →Open endpoints and leftover files
Probes debug, health, admin-looking, and internal routes, plus .env files, .git metadata, backups, and published source maps served from your web root.
CORS, cookies, and CSRF
Wildcard or origin-reflecting CORS with credentials, cookies missing HttpOnly, Secure, or SameSite, forms without CSRF tokens, and open redirects.
Read more →TLS, DNS, and domain hygiene
Certificate expiry and weak TLS signals, mixed content, SPF and DMARC records, subdomain takeover signals, and missing legal pages.
Read more →How the Website Vulnerability Scanner works
- Step 1
Paste any URL you own
The live URL is the only input. No repository access, no database credentials, no app login, no agent to install, and no Ubserve account.
- Step 2
We run the public check set in parallel
We fetch the page and follow safe redirects, then in parallel download and scan its JavaScript bundles, read response headers, probe common endpoints and leftover files, test CORS by varying the Origin header, inspect cookies and client storage, check the TLS certificate, read public DNS records, and - where a public database key is present - test what that database returns.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I check my website for vulnerabilities?
You cannot know from the inside, because the code you read is not the thing attackers touch. What matters is what your deployed site answers: whether a secret sits in the JavaScript it serves, whether an API route returns data with no session, whether a table comes back to a request carrying only a public key, whether the certificate is valid and the headers are set. Every one of those is testable from outside with nothing but the URL, which is exactly what this scan does.
What is a frontend security scan?
It is an unauthenticated check of everything your site already hands to the public: the HTML at your URL, the JavaScript bundles that page links to, the HTTP response headers, the TLS certificate, public DNS records, and the endpoints that answer without credentials. It is not a penetration test and it does not attack your app - it looks at the same surface any visitor's browser sees, and reports the parts of it that should not be there. Issues that only appear behind a login need a connected audit instead.
How does the scanner work?
We fetch your URL and follow safe redirects, then run the checks in parallel: download the JavaScript bundles the page references and match them against provider key patterns, read the response headers, request common debug, admin, config, and backup paths, vary the Origin header to test CORS, inspect cookies and browser storage, check the TLS certificate and mixed content, read public DNS records, and - if a public database key is present in the bundle - test what that database returns. Results are scored into a letter grade and a ranked report.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my source code, database, or server?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
How is this different from a tool like Snyk?
They look at different things. Snyk is built around your codebase and dependency manifests - it reads what you wrote and what you pulled in, inside your repository and CI. This scan has no access to any of that; it reads your deployed URL from outside, the way a stranger does, which is how it catches a secret that survived into the bundle, a table answering without a policy, or a header that never made it to production. A repository scan cannot see a deployment mistake, and this cannot see an unshipped one. We wrote up the comparison in more detail on its own page.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →Exposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
Open tool →
DatabaseSupabase RLS Checker
Probes your Supabase tables with the anon key from your own bundle to see which ones answer without Row Level Security.
Open tool →
AI BuildersCursor Security Scanner
Checks a Cursor-built app for the protections the model never mentioned: throttling, CSRF tokens, and access control.
Open tool →Keep reading
- Vulnerabilities we catchThe full list of what a public scan can find.
- Ubserve compared with other scannersRepository scanning and deployment scanning, side by side.
- SAST vs DAST for AI-built appsWhy reading code and testing a deployment find different bugs.
- How to secure a vibe-coded app before productionOrder of operations for a launch week.
- Why vibe-coded apps keep getting hackedThe patterns behind the incidents.
Run the Website Vulnerability Scanner
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.