Methodology

The 51 checks

19 checks run in both modes, 32 more only in a full scan.

Secrets and keys (passive + full)

API keys of OpenAI, Anthropic, Groq, Stripe, Resend, Brevo, HuggingFace, Pinecone; Firebase service accounts; Supabase service_role; database URLs with passwords; private keys — searched in HTML, JavaScript bundles and source maps.

Client-side code (passive + full)

XSS patterns (dangerouslySetInnerHTML, v-html, innerHTML, eval, document.write), tokens in localStorage, JWT analysis (alg none, weak secret, missing expiry, admin flags), fail-open auth (catch blocks that let requests through), log injection, SQL injection surfaces, SSRF surfaces, AI tool mentions.

Web hygiene (passive + full)

Content-Security-Policy and its weak directives, HSTS, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy, cookie flags (Secure, HttpOnly, SameSite), CORS with credentials, open redirect, mixed content, SRI for external scripts, version disclosure.

Databases and storage (full)

Supabase RLS per table, public Supabase Storage buckets, Firebase Realtime Database, Firestore, Firebase Storage, S3 and GCS buckets with public listing.

AI surface (full)

Discovery of AI endpoints, prompt injection, jailbreak, system prompt leak, AI-mediated XSS, excessive agency (tool calling), indirect injection surfaces (file upload, RAG and vector stores).

Exposure (full)

Open .env and .git, backup dumps, admin panels, Swagger and OpenAPI documents, GraphQL introspection, unauthenticated APIs that return data, path traversal, dangerous HTTP methods, debug pages, stack traces and SQL errors, Host header injection, cache poisoning, hidden debug parameters.

Infrastructure and supply chain (full)

TLS quality (legacy versions and ciphers, HSTS preload), HTTP to HTTPS redirect, subdomain enumeration through Certificate Transparency, subdomain takeover, slopsquatting (packages invented by AI that do not exist in npm), vulnerable dependencies from package.json against the OSV database, Next.js CVEs, and a "does it actually work" pass on the app's own pages and login form.

What we do NOT check

This list matters more than the previous one, because it defines the limits of what the report means.

• Authenticated areas. We do not log in as a user or admin, so we do not see what is behind the login.
• Business logic abuse. We do not test whether you can buy for a negative price, reuse a coupon twice or escalate a role by editing a request.
• Deep exploitation. We do not run full exploit chains, privilege escalation or lateral movement. We confirm a weakness exists, not how far it goes.
• Network and infrastructure. No port scanning, no service CVE scanning on your server, no Windows or Active Directory assessment.
• Brute force and denial of service. We never attack availability and never guess passwords.
• Mobile apps and native clients.
• Your source code and CI/CD. Only what your deployment exposes publicly.
• Social engineering and phishing of your staff.

A clean report means "no known classes of problems were found from the outside in a short automated pass". It does not mean "the application is secure". No scanner can honestly promise that.

How the 0–10 score is calculated

Each finding has a severity:

• CRITICAL — 25 points
• HIGH — 12 points
• MEDIUM — 6 points
• LOW — 2 points
• INFO — 0 points

Points are summed per check type, and one check type can contribute at most 50 points — otherwise a hundred copies of the same minor issue would drown the real picture. The score is 10 − total/10, and then a ceiling is applied:

• any CRITICAL finding → no higher than 4.0
• two or more HIGH findings → no higher than 6.0
• five or more MEDIUM, or six MEDIUM+LOW → no higher than 7.5
• three or more MEDIUM+LOW → no higher than 8.5

The ceilings exist because a high score next to an open database would be a lie.

Confidence, false positives and proof

Every finding carries a confidence level. High confidence means we saw the actual evidence: the key was in the bundle, the table returned rows, the header was missing.

Findings of HIGH and CRITICAL severity include a command you can run yourself to reproduce the issue. If it does not reproduce for you, press "False positive" — the finding is remembered by its fingerprint (type, title and location) and hidden from future reports without hiding other issues of the same type elsewhere.

Legal boundaries

We scan only sites you own or are explicitly authorised to test. A full scan requires proof of domain ownership, and that proof expires: after 30 days you verify again. We do not scan systems in sanctioned jurisdictions.