ONE FREE SCAN — NO SIGNUP

Scan your own code right now

Paste a snippet or upload a single file. Real scan, real results, with the 30 free rules. Sign up for unlimited scans and the full 131-rule set.

Try it now

Paste code or upload a file — no signup required. Scanned with 30 free rules.

Or look at a finished example report

This is a demo scan

These are example results from scanning a typical AI-generated SaaS application. Scan your own code to see real results.

D
Security Grade35/100

my-saas-app

Multiple critical vulnerabilities found. This application needs significant security improvements before deployment.

ExpressSupabaseStripe131 rules
3
Critical
Exploitable vulnerabilities that could lead to data breaches, unauthorized access, or system compromise. Fix these immediately.
1
High
Serious security weaknesses that attackers could exploit. These should be fixed before deploying to production.
1
Medium
Security issues that could become exploitable under certain conditions. Plan to fix these soon.
0
Low
Minor issues or best practice violations with limited security impact. Good to fix when time allows.
47
Files Scanned
5
Total Findings

Scanned 47 files in 2.3s

OWASP Top 10 (2021) Coverage

The OWASP Top 10 is the industry-standard list of the most critical web application security risks. Each category represents a class of vulnerabilities that attackers commonly exploit.
1
Broken Access Control
1
Cryptographic Failures
2
Injection
OK
Insecure Design
1
Security Misconfiguration
OK
Vulnerable Components
OK
Auth Failures
OK
Data Integrity
OK
Logging Failures
OK
SSRF

Findings (5)

criticalVC001PublicA02:2021CWE-798SOC2: CC6.1SOC2: CC6.7ISO: A.8.28ISO: A.8.9Hardcoded API Key or Secret
.env:1
>    1 | DATABASE_URL=postgres://admin:****@db.example.com:5432/myapp
     2 | SUPABASE_ANON_KEY=eyJ...
     3 | STRIPE_SECRET_KEY=sk_live_****
Fix: Move this secret to an environment variable and add it to .env (not committed to git).
criticalVC005PublicA01:2021CWE-352SOC2: CC6.1SOC2: CC6.6ISO: A.8.26ISO: A.8.25Unprotected Stripe Webhook Endpoint
server.js:39
    37 | 
    38 | // Stripe webhook
>   39 | app.post("/api/webhooks/stripe", async (req, res) => {
    40 |   const event = req.body;
Fix: Verify the Stripe webhook signature using stripe.webhooks.constructEvent().
criticalVC006PublicA03:2021CWE-89SOC2: CC6.1SOC2: CC7.1ISO: A.8.25ISO: A.8.28Potential SQL Injection
server.js:34
    32 |   });
    33 |   // raw SQL
>   34 |   const result = await db.query(`SELECT * FROM products WHERE name LIKE '%${query}%'`);
    35 |   res.json(result);
Fix: Use parameterized queries: db.query('SELECT * FROM users WHERE id = ?', [userId])
highVC007PublicA03:2021CWE-79SOC2: CC6.1SOC2: CC7.1ISO: A.8.25ISO: A.8.28Potential Cross-Site Scripting (XSS)
Dashboard.tsx:29
    27 |         <div
    28 |           key={u.id}
>   29 |           dangerouslySetInnerHTML={{ __html: u.bio }}
    30 |         />
Fix: Sanitize user input before rendering: DOMPurify.sanitize(userInput)
mediumVC009PublicA05:2021CWE-942SOC2: CC6.6SOC2: CC7.1ISO: A.8.9ISO: A.8.20CORS Allows All Origins
server.js:9
     7 | 
     8 | // CORS
>    9 | app.use(cors());
    10 |
Fix: Restrict CORS: cors({ origin: 'https://yourdomain.com' })

Ready to scan your own code?

Upload your project files or paste a GitHub URL. Get a full security report in seconds — no signup required for your first scan.

Scan Your Code — FreeCreate Free Account