All checks
Every check SniffPup runs
Everything below is live today. Free scans are passive: we only look at what any visitor's browser can see. Only scan sites you own or are authorized to test.
In every scan
Run on every free scan of a live URL, in this order. You can watch each one run live when you scan.
- Loading your page like a visitor's browserOne GET of the URL you entered, following redirects
- Looking for leaked keys in the page and inline scriptsOpenAI, Anthropic, Stripe, Supabase, AWS, GitHub, Slack, Resend and more
- Reading your JavaScript files for keys and old librariesUp to 20 same-site JS files, plus the chunks they load
- Checking for a public source mapIs your original source code downloadable?
- Checking for exposed files.env, .git, .npmrc, cloud credentials, SQL dumps, backups
- Checking security headers, cookies and the HTTPS redirectHSTS, CSP, clickjacking, cookie flags, http → https
- Checking your HTTPS certificateExpiry, issuer, name match, trust
- Comparing what GPTBot sees with your browserPlus robots.txt and llms.txt
- Checking AI crawler access and structured dataGPTBot, ClaudeBot, PerplexityBot, llms.txt links
- Spotting a Supabase or Firebase backendFrom the public config your site already ships
- Testing what a stranger can read from your databasePublic key only, read-only, no row data downloaded
- Checking CORSCan any website read your pages as your users?
- Checking your email setupSPF, DMARC and DKIM, DNS lookups only, no mail sent
- Checking speed and accessibility basicsResponse time, compression, page and image size, alt text, labels, language
- Checking your domain, outside scripts and legal linksDomain expiry from the public registry, http:// files, outside script hosts, privacy and terms links
Scan your app free → · Exactly what the scanner does · How the score works
Sniff & Fix
Paste-in and repo checks for the bugs AI builders often leave behind.
Payments Doctor: quick check
Paste your Stripe checkout and webhook code and get a list of common payment mistakes, each with fix steps and a prompt for your AI helper.
Open →FreeRepo scan: quick check
Enter a public GitHub repo to find committed keys and .env files, server-only keys with a public prefix, Supabase tables without row level security, Stripe payment mistakes, and AI cost and access problems, plus a licence check and an SBOM of your npm packages.
Open →FreeAI bill shield
Part of the repo scan: finds AI routes anyone can use on your bill, AI called straight from the browser, and admin pages that are only hidden in the browser, with a spend-limit checklist for each AI provider. Solo and up add login and sign-up limits, bot checks and AI output caps. Reads your code only and never contacts your site.
Open →FreeFake-package checker
Paste a package.json, requirements.txt, pyproject.toml or Pipfile, or scan a repo, to catch package names that don't exist, known malware and risky lookalikes, which AI coding tools sometimes add. You get a corrected file back with any known malware taken out.
Open →Solo and upPayments Doctor: full check
More rules (raw webhook body, payment status, subscription cancellations, prices from the browser, hard-coded signing secrets) and a re-check after you change your code.
Open →Solo and upRepo scan: full check
Adds known security advisories for your npm packages with the version that fixes each, the full payment rules, AI cost and access rules for logins, sign-ups and AI replies, and an AI rules file, with advisories in the SBOM.
Open →Solo and upScan API for build pipelines
Scan your own verified site after each deploy from GitHub Actions or any CI, and fail the build when the score drops below your threshold. Plus Slack and Discord alerts on every paid plan.
Open →Solo and upSniffPup inside your AI coding tool (MCP)
Connect Claude Code, Cursor or another AI coding tool so it can scan your verified site, read each issue with its fix steps, fix your code and scan again.
Open →Free checkers
Each answers one question about your live site in a few seconds.
Free security headers checker for your live site
Check your live site for missing security headers (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), weak cookie flags and a missing HTTPS redirect.
Open →FreeIs your .env public? Free .env exposure checker
Check whether anyone can download your .env, .env.local, .env.production, .git/config or .npmrc from your live site. Passive check that reports variable names only, never values.
Open →FreeFree Supabase service_role key leak checker
Check whether your live site ships a Supabase service_role or sb_secret_ key to the browser. Also shows whether your Supabase URL and public anon key are present, which is normal.
Open →FreeFree Supabase exposed data checker
Check what your live Supabase app shows strangers: leaked service_role or sb_secret_ keys, public .env files, and which tables an anonymous visitor can read with your public key.
Open →FreeLovable app security scanner (live URL)
Free passive scan of your published Lovable app's live URL: secret keys in JavaScript, public .env and .git files, Supabase key exposure and security headers. Pairs with Lovable's scans.
Open →FreeBolt app security scanner for your live site
Free passive scan of your published Bolt.new app: secret keys in VITE_ variables and JavaScript bundles, public .env and .git files, Supabase key exposure and security headers.
Open →FreeCursor app security scan: check your live app
Free passive scan of the app you built with Cursor, once it's live: keys in NEXT_PUBLIC_ and VITE_ bundles, public .env and .git files, source maps, open Supabase tables, CORS and headers.
Open →FreeReplit app security scanner for your live site
Free passive scan of your published Replit app: secret keys in HTML and JavaScript bundles, public .env and .git files, source maps, Supabase or Firebase exposure and security headers.
Open →FreeFree Firebase security rules checker (live site)
Check whether strangers can read your live Firebase app's data: an anonymous read of your Realtime Database root, up to 4 common Firestore collections and a Storage file listing. Read-only.
Open →FreeFree source map exposure checker for your site
Check whether the source map your live site's JavaScript points to can be downloaded, which lets anyone read your original source code. One passive request, part of the free scan.
Open →FreeFree Supabase RLS policy explainer (paste SQL)
Paste your Supabase schema SQL, pg_policies rows or database advisors JSON and get each risky policy explained in plain English with what to change. Runs in your browser; nothing is uploaded.
Open →FreeFree robots.txt AI crawler checker
See which AI crawlers (GPTBot, ClaudeBot, PerplexityBot and more) your robots.txt allows, whether your server lets them in, and if you have an llms.txt. Free, passive.
Open →FreeFree frontend env variable leak checker
Check whether your live site's JavaScript ships secret keys or server-only env variables (VITE_, NEXT_PUBLIC_, REACT_APP_) to every visitor. Free, passive, keys never shown.
Open →FreeFree CORS misconfiguration checker
Check whether any website can read your page or API responses, including as your signed-in users: reflected origins, null and credentials. One passive GET request.
Open →FreeFree outdated JavaScript library checker
Find JavaScript libraries on your live site (jQuery, Bootstrap, Lodash, AngularJS and more) with publicly known vulnerabilities, and the version that fixes them. Free, passive.
Open →FreeFree SPF, DMARC and DKIM checker
Check whether someone could send email pretending to be your domain: SPF, DMARC policy and DKIM on common selectors. Free, DNS lookups only, no email sent.
Open →