FREE SCANS — NO SIGNUP

Scan your own code right now

Paste a snippet or upload a single file. Real scan, real results, with the 30 free rules. Sign up free for 5 scans a day and scan history; paid plans unlock the full 223-rule set.

Try it now

Paste code or upload a file — free instant scan, no signup required.

🔒 Scanned in memory and never stored by XploitScan. Signed-in scans can run AI review of findings (free accounts: 5/day; Privacy Policy §7). Prefer fully local? Signed out and without ANTHROPIC_API_KEY set, the CLI keeps your code on your machine: npx xploitscan@latest scan .

Or look at a finished example report

This is a demo scan

This is an illustrative example of a report for a typical AI-generated SaaS app. Scan your own code to see real results.

F
Security Grade45/100

my-saas-app

Multiple critical vulnerabilities found. This application needs significant security improvements before deployment.

ExpressSupabaseStripe223 rules
3
Critical
Exploitable vulnerabilities that could lead to data breaches, unauthorized access, or system compromise. Fix these immediately.
1
High
Serious security weaknesses that attackers could exploit. These should be fixed before deploying to production.
1
Medium
Security issues that could become exploitable under certain conditions. Plan to fix these soon.
0
Low
Minor issues or best practice violations with limited security impact. Good to fix when time allows.
47
Files Scanned
5
Total Findings

Scanned 47 files in 2.3s

OWASP Top 10 (2021) Coverage

The OWASP Top 10 is the industry-standard list of the most critical web application security risks. Each category represents a class of vulnerabilities that attackers commonly exploit.
1
Broken Access Control
1
Cryptographic Failures
2
Injection
OK
Insecure Design
1
Security Misconfiguration
OK
Vulnerable Components
OK
Auth Failures
OK
Data Integrity
OK
Logging Failures
OK
SSRF

Findings (5)

criticalVC001PublicA02:2021CWE-798SOC2: CC6.1SOC2: CC6.7ISO: A.8.28ISO: A.8.9ISO: A.5.17Hardcoded API Key or Secret
.env:1
>    1 | DATABASE_URL=postgres://admin:****@db.example.com:5432/myapp
     2 | SUPABASE_ANON_KEY=eyJ...
     3 | STRIPE_SECRET_KEY=sk_live_****
Fix: Move this secret to an environment variable and add it to .env (not committed to git).
criticalVC005PublicA01:2021CWE-352SOC2: CC6.1SOC2: CC6.6ISO: A.8.26ISO: A.8.28Unprotected Stripe Webhook Endpoint
server.js:39
    37 | 
    38 | // Stripe webhook
>   39 | app.post("/api/webhooks/stripe", async (req, res) => {
    40 |   const event = req.body;
Fix: Verify the Stripe webhook signature using stripe.webhooks.constructEvent().
criticalVC006PublicA03:2021CWE-89SOC2: CC6.1SOC2: CC7.1ISO: A.8.25ISO: A.8.28Potential SQL Injection
server.js:34
    32 |   });
    33 |   // raw SQL
>   34 |   const result = await db.query(`SELECT * FROM products WHERE name LIKE '%${query}%'`);
    35 |   res.json(result);
Fix: Use parameterized queries: db.query('SELECT * FROM users WHERE id = ?', [userId])
highVC007PublicA03:2021CWE-79SOC2: CC6.1SOC2: CC7.1ISO: A.8.25ISO: A.8.28Potential Cross-Site Scripting (XSS)
Dashboard.tsx:29
    27 |         <div
    28 |           key={u.id}
>   29 |           dangerouslySetInnerHTML={{ __html: u.bio }}
    30 |         />
Fix: Sanitize user input before rendering: DOMPurify.sanitize(userInput)
mediumVC009PublicA05:2021CWE-942SOC2: CC6.6SOC2: CC7.1ISO: A.8.9ISO: A.8.26CORS Allows All Origins
server.js:9
     7 | 
     8 | // CORS
>    9 | app.use(cors());
    10 |
Fix: Restrict CORS: cors({ origin: 'https://yourdomain.com' })

Ready to scan your own code?

Paste code or upload a file for a free scan — no signup. Create a free account to upload whole projects or scan a GitHub repo.

Scan Your Code — FreeCreate Free Account