Complete Scan · $47 · instant

The complete external security scan, done the moment you pay.

The attacker’s-eye view, done completely: every common table probed (not just the first), anonymous write attempts, storage buckets, auth endpoints, security headers and exposed config. You get the full written report with the exact fix for each finding, straight away. No call. No human in the loop.

This is the complete external view: everything reachable from outside without your credentials. It is not a clean bill of health. A real attacker with an account, or a look at your code, can expose things only the inside review (the $299 Ship Check) catches.

Instant and self-serve. The full external scan runs the moment you pay and the report opens straight away, no call and no waiting.

Free preview vs $47 complete vs $299 with-access

The $47 is the whole external battery. The inside view, your per-table policies, secrets and access rules reviewed by a senior engineer, is the $299 Ship Check, and your $47 comes off it for 24 hours after this report.

CheckFree preview$47 complete$299 with-access
Reachable + valid SSLyesyesyes
Live API keys exposed in page / JS bundleheadline RED patternsfull pattern setyes + server-side secret audit
Supabase project + anon key detectedyesyesyes
Anonymous table READ (RLS gap)first table, spot-checkevery probed tableevery table + RLS policy review
Anonymous table WRITE / insertnoyes (safe no-op probe)yes + per-policy review
Storage bucket exposurenoyesyes + bucket policy review
Auth endpoint confignoyes (external probes)yes + full auth config review
Security headers (HSTS, CSP, X-Frame, nosniff, Referrer-Policy)noall fiveyes
Exposed config / paths (.env, /.git, source maps)noyesyes
Per-table RLS policy correctnessno (not visible from outside)no (not visible from outside)yes (the point of this tier)
Written report + exact fixesone-line verdictfull report + fixesfull report, human-ranked
Human reviewnonoyes (senior engineer)
Deliveryinstantinstant, automatedwithin 48h of access