free security scan
Free website security scan for AI-built apps
Paste your live URL for a free website security scan. In about 60 seconds Sayver checks your app for exposed API keys, missing security headers, and Supabase misconfigurations, then explains every finding in plain English with a fix you can paste straight back into your AI builder.
Free to try. Sign in to run your first scan.
What the free scan checks
The free scan reads your live site the way a browser or an attacker would — no install, no code access, just your public URL.
- ✓HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options
- ✓Exposed API keys and secrets in your client-side bundle
- ✓Common exposed paths like /.env and /.git/config
- ✓Supabase exposure signals (anon/service-role keys, missing RLS)
- ✓DNS and email security — SPF, DKIM, DMARC
- ✓A security score with each finding ranked by danger
Security guides by AI builder
Building with a specific tool? Start with the checklist for it, then run a scan.
Free security scan — FAQ
Is the website security scan really free?
Yes. You can run a passive scan of any live URL for free — no credit card. It checks your public surface (security headers, exposed paths, DNS and email security, and signs of leaked keys) and returns a security score with plain-English findings.
What does the free scan check?
The free scan reads your live site the way a browser or attacker would: HTTP security headers (CSP, HSTS, X-Frame-Options), common exposed paths like /.env, DNS and email records (SPF, DKIM, DMARC), and indicators of API keys or secrets exposed in your client-side code.
Do I need to install anything or share my code?
No. The free scan only needs your public URL. Deeper features — GitHub code scanning and live runtime threat detection — are optional and opt-in on a paid plan.
Is it safe to scan my own site?
Yes. The scan is passive and rate-limited: it reads publicly available responses and DNS records. It does not attempt to exploit anything or log in. You should only scan sites you own or are authorized to test.
Will it work for an app I built with Lovable, Cursor, or Bolt?
Yes — that's exactly who it's for. Apps built with AI coding tools tend to ship with the same handful of gaps (missing headers, exposed Supabase keys, no rate limiting). Sayver is tuned to catch those and explain the fix in plain English.