What does your appalready tell strangers?
A production build often ships more than it meant to. Paste a URL and we'll read what it serves any browser — starting with whether your original source code is downloadable.
We read what the site already serves to any browser — its HTML, its JavaScript bundles, its response headers. Nothing else. No injection attempts, no login attempts, and we do not query anybody's database.
What this does
- Loads the page like a browser would
- Reads the JavaScript bundles it references
- Checks whether source maps are actually served
- Notes the response headers
What it never does
- Send injection or auth-bypass payloads
- Query a database with a key it found
- Log in, submit forms, or change anything
- Publish detailed findings about a domain to strangers
This is recon, not a full scan
Everything reachable from outside is a fraction of what is in your codebase. A URL scan can tell you your source maps are public; it cannot tell you the authorization check is missing from an API route, because that code never reaches the browser. When you want the real answer, point the scanner at the source.
One exception, and it needs a proof. If your build is serving source maps, the original code inside them is downloadable by anyone — so if you show us you control that host, we'll pull it down and run the full rule set over it. That still only covers the code your build shipped to browsers, and it is not offered for a host you have not verified.