The Exposure Scan
It reads exactly what your visitors' browsers receive — the page, the scripts it loads, the headers that come with them — and grades what's sitting in the open. It takes about fifteen seconds, it's free, and it doesn't need an email address.
No public URL yet? Take the 3-minute check →
The scan fetches your page the way a browser does, follows the scripts that page tells the browser to load, and reads the headers that arrive with them. It looks for keys and tokens that ended up in code the browser downloads, for configuration files that answer when they shouldn't, for source maps left in production, and for the seven response headers that decide how much a hostile page can do with yours. Everything it finds, a stranger with devtools open could have found first.
It never signs in, never tries a password, never touches your database, and never sends your app anything a normal visit wouldn't. It is a reader, not a prober — one pass over what you already publish. It only ever looks at the address you gave it and the scripts that address asks for, which is why the ownership box above is not a formality.
You get a private link to your report. I store the type of each finding, the file it was in and how many matches there were — never the value of anything found, not even a prefix. The shareable version of the page shows your grade and your hostname and nothing else; the findings stay on your own link. Full detail of every check and how the letter is worked out is on the methodology page.