All 213 checks, by module, with the severity each finding carries. There are no check tiers. Every scan runs every check — what varies is how much of your application the scanner is allowed to reach.
Two scans can return very different amounts of detail, and it is never because one bought a better plan: a plan changes how many scans you get, not which checks run. Four things decide how deep a scan reaches.
A DNS TXT record at _secscan-challenge.<domain>, or a file at /.well-known/secscan-verification.txt
Without it only passive checks run. This is the control that stops the platform being used as an anonymous attack proxy, so it fails closed — a lookup error denies rather than allows.
A session cookie or bearer token you paste, or a form login driven by a headless browser
On most applications nearly everything of value sits behind auth. A scan that never signs in never sees it.
A second set of credentials, supplied alongside the first — or, if you tick the option for that scan, a disposable account the scan creates through your public signup form
The question is not whether a page is reachable but whether the wrong person can reach it. Comparing one account against nothing proves nothing.
Operator-side: a public callback address, which for secscan.us is the service’s own origin (or a dedicated host set with OOB_BASE_URL)
A server tricked into fetching an attacker URL produces nothing in its own response. Proof has to arrive somewhere else.
Unverified domains get passive checks only. Active probing stays locked until you prove you control the target, and the report says so explicitly rather than quietly returning less. See how verification works.
scanner.ts Passive analysis of the first response: HTTPS, HSTS, the Content-Security-Policy and the other security headers, and cookie flags. Nothing extra is sent.
| Check | Severity |
|---|---|
| No HTTPS / Plaintext HTTP | Critical |
| Missing HTTP Strict-Transport-Security (HSTS) not raised for a host on the browsers' HSTS preload list; a redirect to HTTPS does not excuse it | Medium |
| HSTS max-age Too Short under 6 months | Low |
| Missing Content-Security-Policy (CSP) a policy delivered in a <meta http-equiv> tag counts as present | High |
| CSP script-src Contains Wildcard | High |
| Content-Security-Policy is report-only (not enforced) reported as Medium, because the browser still runs the script | Medium |
| Weak Content-Security-Policy (unsafe-inline / unsafe-eval in script-src) | Medium |
| Content-Security-Policy Allows Inline Styles Info, and not weighed in the grade: style-only, so no script can run | Info |
| CSP Missing object-src 'none' Directive not raised when default-src already restricts plugin content | Low |
| CSP Missing base-uri Directive | Low |
| Missing Clickjacking Protection (X-Frame-Options) | Medium |
| Missing X-Content-Type-Options: nosniff | Low |
| Missing Referrer-Policy Header | Info |
| Missing Permissions-Policy Header | Info |
| Missing Cross-Origin-Opener-Policy (COOP) | Info |
| Missing Cross-Origin-Embedder-Policy (COEP) | Info |
| Missing Cross-Origin-Resource-Policy (CORP) | Info |
| Missing Cache-Control Headers | Info |
| Permissive CORS Policy (Wildcard Origin) Low if Access-Control-Allow-Credentials: true is also sent; a bare * is normal for public content | Info |
| Mixed Content (HTTP Resources on HTTPS Page) | Medium |
| Server Version Disclosure | Info |
| X-Powered-By Header Discloses Technology Stack | Info |
| Session Cookie Missing Secure Flag | High |
| Session Cookie Missing HttpOnly Flag | Medium |
| Session Cookie Missing SameSite Attribute | Low |
| Non-Session Cookie Missing Secure Flag | Low |
| Non-Session Cookie Readable by JavaScript | Info |
| Non-Session Cookie Missing SameSite Attribute | Info |
probes.ts Requests for files and folders that should never be public: .env, .git, backups, admin panels, actuators and WEB-INF. A path counts only when it differs from the site's catch-all response.
| Check | Severity |
|---|---|
| Sensitive file or path publicly readable (81 paths) | Varies |
probes.ts robots.txt entries that list sensitive application paths, which tell an attacker where to look.
| Check | Severity |
|---|---|
| robots.txt Discloses Sensitive Application Paths | Low |
probes.ts Third-party scripts and stylesheets loaded without an integrity hash, and scripts loaded from hosts tied to a known supply-chain attack.
| Check | Severity |
|---|---|
| External Resources Missing Subresource Integrity (SRI) | Medium |
| Page Loads a Script From a Host Tied to a Known Supply-Chain Attack polyfill.io, BootCDN, bootcss, Staticfile and the domains tied to the 2024 Polyfill.io attack | High |
probes.ts Error pages that show stack traces or debug output, and the Flask/Werkzeug interactive debugger.
| Check | Severity |
|---|---|
| Verbose Error Pages Expose Internal Application Details | Medium |
| Flask/Werkzeug Interactive Debugger Exposed | Critical |
probes.ts Whether plain HTTP requests are redirected to HTTPS.
| Check | Severity |
|---|---|
| HTTP Traffic Not Redirected to HTTPS | High |
probes.ts Whether rate-limit headers are advertised on responses.
| Check | Severity |
|---|---|
| Rate Limiting Not Advertised in Response Headers | Low |
probes.ts X-Frame-Options, checked for a value that actually protects the page.
| Check | Severity |
|---|---|
| X-Frame-Options Header Misconfigured | Medium |
probes.ts Folders that list their own contents.
| Check | Severity |
|---|---|
| Directory Listing Enabled | Medium |
probes.ts Whether the site publishes a security contact (RFC 9116).
| Check | Severity |
|---|---|
| Missing security.txt (RFC 9116) | Info |
probes.ts Which HTTP methods the server advertises, and whether TRACE and CONNECT are enabled.
| Check | Severity |
|---|---|
| HTTP TRACE Method Enabled (Cross-Site Tracing) | Medium |
| Write HTTP Methods Advertised | High |
| HTTP CONNECT Method Enabled | Medium |
probes.ts Whether the site reflects arbitrary origins, or allows credentials to them.
| Check | Severity |
|---|---|
| CORS Misconfiguration — Credentials Allowed from Arbitrary Origin | High |
| CORS — Origin Reflected Without Credentials | Low |
probes.ts Whether a redirect parameter sends visitors to an outside address.
| Check | Severity |
|---|---|
| Open Redirect Vulnerability | Medium |
probes.ts Supabase REST endpoints checked for tables that can be read without signing in.
| Check | Severity |
|---|---|
| Supabase Tables Exposed — Row Level Security (RLS) Disabled | Critical |
| Supabase Detected — Verify Row Level Security (RLS) | Info |
dnsChecks.ts SPF, DMARC, DKIM and DNSSEC for the domain, checked through DNS lookups.
| Check | Severity |
|---|---|
| Missing SPF Record — Email Spoofing Possible | High |
| SPF Record Uses +all (Allows Any Sender) | Critical |
| SPF Record Uses ?all (Neutral — No Enforcement) | Medium |
| SPF Record Exceeds DNS Lookup Limit | Low |
| Missing DMARC Record — No Email Authentication Enforcement | High |
| DMARC Policy Set to None (Monitoring Only — No Enforcement) | Medium |
| DMARC Record Missing Aggregate Report Address (rua=) | Info |
| No DKIM Records Found Under Common Selectors | Low |
| DNSSEC Not Enabled | Info |
mailTls.ts STARTTLS and the certificate of the domain's mail server.
| Check | Severity |
|---|---|
| Mail Server Does Not Offer STARTTLS | Medium |
| Mail Server TLS Certificate Expired | High |
| Mail Server TLS Certificate Expiring Soon | Low |
structuredData.ts JSON-LD, Open Graph and Twitter card metadata, and what the markup reveals.
| Check | Severity |
|---|---|
| Internal Hostname Exposed in Structured Data | Low |
| Social Preview Asset Referenced Over HTTP | Low |
| Canonical URL Points to an External Domain | Low |
| Malformed JSON-LD Structured Data | Info |
| Structured Data Missing @context or @type | Info |
| No Structured Data Found | Info |
| Incomplete Open Graph Metadata | Info |
| Twitter Card Metadata Absent | Info |
| Page Excluded From Search Indexes | Info |
nextjsProbe.ts Secrets embedded in the page's __NEXT_DATA__ JSON.
| Check | Severity |
|---|---|
| Stripe Live Secret Key in __NEXT_DATA__ | Critical |
| Supabase Service Role Key in __NEXT_DATA__ | Critical |
| Private Key in __NEXT_DATA__ | Critical |
| AWS Access Key ID in __NEXT_DATA__ | Critical |
| AWS Secret Access Key in __NEXT_DATA__ | Critical |
| GitHub Token in __NEXT_DATA__ | Critical |
| SendGrid API Key in __NEXT_DATA__ | High |
| Slack Token in __NEXT_DATA__ | High |
| Hardcoded Database Connection String in __NEXT_DATA__ | Critical |
cveCheck.ts Software versions detected from headers and pages, matched against known CVEs, end-of-life dates and OSV.
| Check | Severity |
|---|---|
| PHP end-of-life release | Critical |
| Nginx version with a known CVE | Varies |
| Nginx end-of-life release cycle | High |
| Apache version with a known CVE | Varies |
| Apache HTTPD end-of-life release branch | Critical |
| Microsoft IIS 6.0 — CVE-2017-7269 WebDAV RCE | Critical |
| Detected version matched against OSV.dev | Varies |
manifestSca.ts Dependency manifests that are publicly readable, matched against OSV.
| Check | Severity |
|---|---|
| Vulnerable dependency named in an exposed manifest | Varies |
jwtAnalysis.ts JWTs seen in responses, checked for alg none, a missing expiry, a long lifetime and sensitive payload data.
| Check | Severity |
|---|---|
| JWT Using alg:none — Signature Verification Bypass | Critical |
| JWT Has Empty Signature — Possible Verification Bypass | Critical |
| JWT Token Has No Expiry (exp Claim Missing) | High |
| JWT Uses HS256 Without Expiry — Offline Brute-Force Risk | High |
| JWT Token Lifetime Excessive | Medium |
| Sensitive Data Stored in JWT Payload | Medium |
supabase-probes.ts Supabase and Firebase data reads and writes tried without signing in, plus storage listing and rules.
| Check | Severity |
|---|---|
| Supabase Service Role Key Exposed in Client-Side Code | Critical |
| Supabase Backend Detected | Info |
| Supabase Tables Readable Without Authentication (CVE-2025-48757) | Critical |
| Supabase Tables Returned Empty Results To Anonymous Requests | Info |
| Supabase Tables Accept Unauthenticated Writes | Critical |
| Supabase Backend Detected — RLS Appears Configured | Info |
| Supabase Storage Bucket List Exposed Without Authentication | Medium |
| Firestore Security Rules Allow Unauthenticated Read Access | Critical |
| Firebase Backend Detected — Firestore Rules Appear Restrictive | Info |
| Firebase Realtime Database Open to Unauthenticated Access | Critical |
| Supabase Email Confirmation Disabled | Low |
| Supabase Storage Files Listable Without Authentication | Medium |
| Firebase Storage Files Listable Without Authentication | High |
accessControlFindings.ts Whether records that belong to one account can be read by another, or enumerated by editing an identifier.
| Check | Severity |
|---|---|
| Broken Object-Level Authorisation (IDOR) | Critical |
| Records Enumerable by Editing the Identifier | Critical |
| Records Readable Without Signing In | High |
apiProbe.ts Discovered API endpoints checked for missing auth, injection, IDOR and mass assignment.
| Check | Severity |
|---|---|
| API Endpoints Served Without Authentication | High |
| API Records Readable by Another Account | Critical |
| Write Endpoints Reachable Without Authentication | Critical |
| Sensitive Fields Returned by the API | High |
| Privilege Fields Accepted in Request Bodies | Medium |
| No Rate Limiting Observed on Sensitive API Endpoints | Info |
| SQL Injection in API Parameters | Critical |
storageProbe.ts S3, Google Cloud Storage and Azure Blob containers that list their contents publicly.
| Check | Severity |
|---|---|
| Public S3 Bucket Listing | High |
| Public Google Cloud Storage Bucket Listing | High |
| Public Azure Blob Container Listing | High |
baasProbes.ts PocketBase and Appwrite collections readable without signing in.
| Check | Severity |
|---|---|
| PocketBase Collections Readable Without Authentication | Critical |
| Appwrite Collections Readable Without Authentication | Critical |
graphqlProbe.ts Introspection, field suggestions, batching and the IDE, when exposed on a production endpoint.
| Check | Severity |
|---|---|
| GraphQL Introspection Enabled in Production | Medium |
| GraphQL Field Suggestions Enabled | Low |
| GraphQL Query Batching Enabled | Low |
| GraphQL IDE Exposed | Medium |
injectionProbe.ts Reflected XSS, server-side template injection, header (CRLF) injection and error-based SQL injection.
| Check | Severity |
|---|---|
| Reflected Cross-Site Scripting (XSS) | High |
| Server-Side Template Injection | Critical |
| HTTP Header Injection (CRLF) | Medium |
| SQL Injection (Error-Based) | Critical |
pathTraversal.ts Path traversal and local file inclusion.
| Check | Severity |
|---|---|
| Path Traversal / Local File Inclusion (LFI) | Critical |
ssrfProbe.ts SSRF, confirmed by an out-of-band callback.
| Check | Severity |
|---|---|
| Server-Side Request Forgery (SSRF) | Critical |
sourceMaps.ts Public JavaScript source maps that reveal the original source code.
| Check | Severity |
|---|---|
| JavaScript Source Map Exposed — Full Source Code Accessible | High |
apiDocsProbe.ts OpenAPI and Swagger documents that are publicly served.
| Check | Severity |
|---|---|
| Exposed API Documentation (OpenAPI / Swagger) | Medium |
healthEndpointProbe.ts Health endpoints that reveal runtime details.
| Check | Severity |
|---|---|
| Health Endpoint Discloses Runtime Details | Info |
subdomainTakeover.ts Dangling DNS records that point at a service which can be claimed.
| Check | Severity |
|---|---|
| Dangling CNAME to a Claimable Service | Critical |
jsScanner.ts Credentials and AI-provider keys in the page's JavaScript, and AI features called from the browser.
| Check | Severity |
|---|---|
| Credential found in JavaScript (34 secret patterns) 34 secret patterns | Varies |
| AI provider called directly from the browser | Low |
| AI system prompt shipped in client-side code | Low |
crawler.ts Pages reached by following links: sensitive paths, missing headers and cookies on inner pages, and serialized objects in cookies.
| Check | Severity |
|---|---|
| Sensitive path found on a crawled page (8 paths per page) 8 paths per page | Varies |
| Security header missing on internal routes | Varies |
| Insecure Deserialization — serialized object in a cookie | High |
recon.ts A short scan of common ports on the host.
| Check | Severity |
|---|---|
| Unexpected open port | Varies |
tlsCheck.ts The scanner's own TLS check: protocol versions, the certificate (validity, hostname, chain, trust, key and hash) and the negotiated cipher.
| Check | Severity |
|---|---|
| Deprecated TLS Protocol Versions Accepted | Medium |
| TLS Certificate Expired | High |
| TLS Certificate Not Yet Valid | High |
| TLS Certificate Expires Soon | Low |
| TLS Certificate Does Not Match the Hostname | High |
| Self-Signed TLS Certificate | High |
| TLS Certificate Chain Incomplete | Medium |
| TLS Certificate Not Trusted | High |
| TLS Certificate Key Too Short | Medium |
| TLS Certificate Signed With a Weak Hash | Medium |
| Weak Cipher Suite Negotiated | Medium |
| Cipher Suite Without Forward Secrecy | Low |
worker.ts The SSL Labs grade, when SSL Labs is enabled for the deployment.
| Check | Severity |
|---|---|
| Weak TLS Configuration (SSL Labs grade C or below) | Varies |
| TLS Grade Below A (SSL Labs) | Info |
githubSourceProbe.ts Public GitHub repositories found for the domain, checked for credentials in their source.
| Check | Severity |
|---|---|
| Credential found in a public GitHub repository's source (34 secret patterns) 34 secret patterns | Varies |
promptInjectionProbe.ts Whether an AI feature reveals its system prompt when asked.
| Check | Severity |
|---|---|
| LLM Prompt Injection Extracts the System Prompt | Medium |
raceConditionProbe.ts Whether a one-time action succeeds more than once when sent in parallel.
| Check | Severity |
|---|---|
| Race Condition Allows a One-Time Action to Succeed Multiple Times | High |
repoScan.ts Credentials committed to the files of a repository. Repository scans read the repository's files and run no website probes.
| Check | Severity |
|---|---|
| Credential found in the repository's files (secret patterns) the same secret patterns as the website checks | Varies |
repoCheckSupabase.ts Supabase migrations and config, judged per project: RLS, policies, views, functions, storage and anonymous sign-in.
| Check | Severity |
|---|---|
| Supabase Function Runs With Its Owner's Rights and No Pinned search_path | Low |
| Supabase Policy Opens a Table (for a test or demo) a policy whose own comment says it is for tests or a demo is information, not a live hole | Info |
| Supabase View Bypasses Row Level Security (no security_invoker) | Medium |
| Supabase Storage Policy Lets Anyone List and Read Storage objects or named buckets | Medium |
| Supabase Tables Created Without Row Level Security | High |
| Supabase Policy Lets Anyone Insert | Low |
| Supabase Policy Lets Anyone Update, Delete or Read and Write | High |
| Supabase Policy Lets Anyone Read Info for a table with no sensitive columns; High when sensitive | Varies |
| Supabase Policy Lets Every Signed-In User Reach All Rows | Medium |
| Supabase Access Decided From user_metadata | High |
| Supabase SECURITY DEFINER Function Callable by Anyone | Medium |
| Supabase Table Holds a Sensitive-Looking Column | Medium |
| Supabase Storage Bucket Named Like Private Files Is Public | Medium |
| Supabase Anonymous Sign-Ins Are Enabled | Medium |
| Supabase Email Sign-Ups Are Not Confirmed | Low |
repoCheckCi.ts GitHub Actions workflows, Dockerfiles, compose files, Firebase rules and edge functions.
| Check | Severity |
|---|---|
| GitHub Actions Workflow Runs Pull-Request Code With Repository Secrets | High |
| GitHub Actions Shell Step Interpolates Attacker-Controlled Text | High |
| GitHub Actions Workflow Requests write-all Permissions | Medium |
| GitHub Actions Step Prints a Secret | Medium |
| Dockerfile Bakes a Credential Into the Image | High |
| Webhook Edge Function Accepts Unsigned Requests | High |
| Supabase Edge Functions Configured Without JWT Verification | Medium |
| Firestore or Cloud Storage Rules Let Anyone Write | Critical |
| Firestore or Cloud Storage Rules Let Anyone Read Medium, or High when the rule covers every document with a wildcard path | Varies |
| Realtime Database Rules Let Anyone Write | Critical |
| Realtime Database Rules Let Anyone Read | High |
| Dockerfile Pipes a Download Into a Shell | Medium |
| Container Runs as Root | Low |
| Dockerfile Base Image Is Not Pinned | Low |
| Compose Service Runs Privileged | High |
| Compose Service Mounts the Docker Socket Low when mounted read-only | Varies |
| Compose Publishes a Database Port to Every Network Interface Info in a development-only compose file | Varies |
| GitHub Actions Uses Third-Party Actions Pinned to a Mutable Tag | Low |
| GitHub Actions Passes Every Secret to a Called Workflow | Info |
repoCheckCode.ts Source files checked for dangerous code: injection, weak cryptography, insecure cookies, unauthenticated routes and committed .env files.
| Check | Severity |
|---|---|
| Secret Exposed Through a Client-Side Environment Prefix | High |
| eval or new Function on Request Data | High |
| SQL Built From Request Data by String Interpolation | High |
| CORS Allows Any Origin With Credentials | Medium |
| TLS Certificate Verification Disabled | Medium |
| AI Provider Key Used Directly in Browser Code | Medium |
| Hardcoded JWT Signing Secret | High |
| JWT Verification Accepts the none Algorithm | High |
| Raw SQL Built by String Concatenation or Interpolation | Medium |
| Operating-System Command Built From Request Data | High |
| File Path Taken From Request Data | Medium |
| Server Fetches a URL Taken From Request Data | Medium |
| Redirect to an Address Taken From Request Data | Medium |
| Predictable Random Number Used for a Secret | Medium |
| Password Hashed With MD5 or SHA-1 | Medium |
| Session Cookie Without HttpOnly or Secure | Low |
| dangerouslySetInnerHTML With Unsanitised Content | Medium |
| API Route Changes Data With No Sign-In Check Visible | Medium |
| Environment File Committed to the Repository | Medium |
manifestSca.ts Dependencies in the repository's lockfiles and manifests, matched against OSV, including malicious-package advisories.
| Check | Severity |
|---|---|
| Malicious package: | Critical |
| Vulnerable dependency: severity from the advisory; a development-only package is rated one step lower, never above Medium | Varies |
Four checks work by iterating a lookup table. Those 143
entries are signatures, not checks — /.env being exposed and
/.git/config being exposed are one check, run twice. Counting
them individually is how scanners advertise numbers that mean nothing.
| Table | Entries | Source |
|---|---|---|
| Sensitive paths probed | 81 | probes-data.ts |
| Secret patterns matched | 35 | secret-pattern-data.ts |
| Takeover fingerprints | 19 | subdomain-service-data.ts |
| Paths probed per crawled page | 8 | crawler-data.ts |
Risk accumulates per finding, then maps to a letter. The weighting is deliberately steep — one Critical counts as much as two Highs or six Mediums, and the score stops at 100, because a single unauthenticated data read is not offset by good headers.
| Finding | Points |
|---|---|
| Critical | +30 |
| High | +15 |
| Medium | +5 |
| Low | +1 |
| Score | Grade |
|---|---|
| 0–10 | A |
| 11–25 | B |
| 26–45 | C |
| 46–65 | D |
| 66+ | F |
The grade also drives rescan frequency if you turn on continuous monitoring — an A is rechecked every 14 days, a B or C every 7, a D or F every 3. A scan that a bot-protection page answered instead of your site is not graded at all: it is marked “coverage incomplete”, because a clean score there would only mean the scanner never saw the site.
The scan does not assess compliance — no scan can. What it does is map each finding to the specific controls it is evidence for, so a finding can be handed to the person who owns that control. Nothing is scored against a framework, and a clean scan is never reported as a passed control.
| Framework | Version | What a mapped finding means |
|---|---|---|
| SOC 2 | 2017 TSC (rev. 2022) | Trust Services Criteria. Most criteria cover policy, personnel and process no scan can observe; findings speak only to the technical subset. |
| PCI DSS | 4.0.1 | Applies only where cardholder data is stored, processed or transmitted. Requirement 11.3.2 expects an ASV scan — this is not one. |
| ISO/IEC 27001 | 2022 Annex A | Annex A controls. Certification is granted by an accredited body against the management system as a whole, not against a scan result. |
| OWASP ASVS | 4.0.3 | The Application Security Verification Standard is built for exactly this kind of testing, so the mapping is tightest and most meaningful here. |
| NIST SP 800-53 | Rev. 5 | Most controls cover policy, personnel and operations no scan can observe; findings speak only to the technical subset. |
| HIPAA Security Rule | 45 CFR 164.312 (technical safeguards) | Applies only to covered entities and business associates handling electronic protected health information. Whether an addressable specification is required is decided by the covered entity’s own risk analysis, which no scan can perform. |
This mapping is not a compliance assessment, an audit, or an attestation. An application scan observes the HTTP surface of a running system at one point in time; SOC 2, PCI DSS and ISO 27001 are largely about policy, process and personnel that no scan can see. Only a licensed CPA firm issues a SOC 2 report, only a QSA validates PCI DSS, and only an accredited body certifies ISO 27001.
Every account gets 3 free scans every month — every one of these checks, no tier to pick.
Run these 213 checks on your site →