Checks

Each guide explains one outside-in check. Run them against your own URL from the homepage.

• Leaked API keys in the client bundleSecret keys that an AI coding tool left inside JavaScript the browser downloads.
• Exposed .env fileA request for /.env, /.env.local, or /.env.production returns real environment variables.
• Exposed .git directoryThe Git metadata for the project can be downloaded from the website.
• Missing security headersThe homepage response is missing the headers that tell browsers how to behave.
• HTTPS and the certificateThe site is still on HTTP, or the certificate is expired, untrusted, or about to expire.
• Supabase tables without row-level securityThe anon key in the browser can read tables that were meant to stay private.
• SPF and DMARCThe domain does not tell inbox providers who is allowed to send its mail.
• Stripe webhooks that fail quietlyCheckout can look successful while the account never hears that the payment completed.