.env and credentials
Flags committed environment files and high-confidence provider, database, and private-key patterns.
Free website vulnerability scan. No card required.
Website vulnerability scanner for SaaS apps.
Run a free website vulnerability scan on your web app. ScanMySaaS crawls the public site, checks for security issues, and delivers a prioritized report with severity scores and affected URLs.
60+ checks Up to 25 pages Readable report
Latest report
64
Needs attention
8 pages checked
app.acme.test
5 findings · scanned just now
Content Security Policy is missing
Criticalapp.acme.test
Public source map reveals application code
High/_next/static/chunks/app.js.map
Session cookie has no SameSite policy
Medium/login
Prioritized remediation is readyView fixes →
Product demo
See the scan before you run yours.
Watch the original walkthrough, then start with your own public URL. The report now adds clearer findings, affected pages, and a SaaS readiness view for TLS, crawl files, and AI discovery.
Real product flow·No installation required
60+
vulnerability checks
25
pages per scan
15
security categories
1
free first scan
Built with Codex, Claude, or Cursor?
Scan the code before the public app.
The website scanner sees what reached production. The repository scanner checks a public GitHub repository for committed environment files, secret patterns, risky GitHub Actions, exposed client keys, weak Supabase signals, and unsafe build settings. Verified findings can be copied as technical fix prompts for your coding agent.
Read-only. No clone, package install, build, or code execution. Private repository connection is coming later.
GitHub Actions
Reviews token permissions, pull_request_target usage, secret output, and mutable third-party actions.
Supabase boundaries
Looks for service-role exposure and migrations that create tables without visible RLS enablement.
Client and build risk
Checks public secret prefixes, wildcard CORS, raw HTML sinks, eval, and production source maps.
More than a pass or fail
A vulnerability report your team can actually use.
Most scanning tools produce a wall of warnings. ScanMySaaS keeps the affected URL, groups findings by priority, and gives paid users practical remediation for each issue.
Create free account01
Full-site vulnerability scan
Crawl up to 25 reachable pages so the assessment covers more than the homepage.
02
Prioritized security findings
Separate critical and high-risk issues from medium, low, and informational signals.
03
Affected URLs preserved
Keep every finding connected to the exact page where the scanner observed it.
04
Step-by-step remediation
Paid reports explain why a finding matters and provide practical configuration examples.
05
Saved scan history
Return to earlier reports without losing the context behind previous findings.
06
Rescans and score trends
Run a fresh scan after a release and track whether the security score improves over time.
SaaS security field guides
Understand the finding before changing production.
Focused guides connect scanner output to a safer release plan across the public app, GitHub workflows, and database boundaries.
8 min read
Security headers for SaaS: what to add first
A practical guide to CSP, HSTS, clickjacking protection, MIME sniffing, referrer policy, and permissions policy for SaaS teams.
Read guide7 min read
SSL and TLS checklist for a production SaaS
Check certificate trust and expiry, HTTPS redirects, HSTS, mixed content, cookies, and redirect chains before they become incidents.
Read guide7 min read
robots.txt and XML sitemaps for SaaS websites
Configure robots.txt and XML sitemaps without leaking private routes or accidentally blocking the public pages that should rank.
Read guide6 min read
llms.txt for SaaS: useful file, realistic expectations
What an llms.txt file can communicate, what it cannot guarantee, and how to publish a concise version for a SaaS product.
Read guide8 min read
Exposed files and source maps in production
Find and remove public environment files, Git metadata, backups, debug pages, and JavaScript source maps from a SaaS deployment.
Read guideHow it works
How does a web vulnerability scanner work?
Start with a URL, let the automated scanner inspect the public surface, then use the report to decide what to verify and fix first.
STEP 01
Point us at your app
Enter a public URL you own or are authorized to test.
STEP 02
We inspect the surface
The crawler discovers pages and checks observable security signals.
STEP 03
Work down the risk
Open the report, address priority findings, then run a fresh scan.
Security coverage
What our website vulnerability scanner checks for.
ScanMySaaS runs 60+ automated checks across the exposed web application. It tests public signals only—it does not log in, exploit targets, or replace a human security review.
SSL & transport
SSL/TLS use, HTTPS redirects, HSTS, mixed content, and downgrade risks.
Security headers
CSP, framing protection, MIME sniffing, permissions policy, referrers, and more.
Exposed files
Public environment files, Git metadata, backups, logs, source maps, and debug paths.
Cookies & forms
Secure, HttpOnly, and SameSite flags plus observable CSRF protection gaps.
Client-side risk
Unsafe JavaScript patterns, detectable outdated libraries, and injection signals.
App exposure
Technology leakage, public API docs, open redirects, DNS signals, and CORS.
AI discovery
llms.txt availability and a readable public resource map for compatible AI tools.
Crawl readiness
robots.txt, XML sitemap, canonical URL, homepage indexability, and security.txt.
Your first scan is free
Know what your launch left exposed.
No credit card. Use it on a website you own, keep the report, and decide what deserves attention.
Vulnerability scanner FAQ
Before you scan your SaaS.
How do I scan a SaaS application for security vulnerabilities?
Enter a public URL you own or are authorized to test. ScanMySaaS crawls up to 25 reachable pages, runs more than 60 automated website vulnerability checks, and returns a prioritized report with severity, affected URLs, and finding descriptions.
How does a website vulnerability scanner work?
A website vulnerability scanner inspects the public surface of a web application for observable security issues and misconfigurations. ScanMySaaS checks transport security, response headers, cookies, forms, exposed files, client-side code, redirects, DNS and email-security signals, then groups the findings by severity.
What types of vulnerability does the scanner detect?
The scanner looks for SSL and HTTPS problems, missing or unsafe security headers, risky cookie settings, exposed environment or backup files, CORS mistakes, open redirects, source maps, outdated client-side libraries, unsafe JavaScript patterns, and other publicly observable web application risks.
Is ScanMySaaS a free website vulnerability scanner?
Yes. Your first scan is free, requires no credit card, and can inspect up to 25 reachable pages. The free report includes the security score, severity breakdown, affected URLs, and finding descriptions. Paid plans add detailed remediation guidance, monthly credits, rescans, saved history, and score trends.
How is ScanMySaaS different from Burp Suite or Nikto?
ScanMySaaS is designed as a quick, browser-based outside-in check for SaaS founders and product teams. It requires no installation or command line, but it is not a replacement for Burp Suite, Nikto, manual penetration testing, or a professional security review.
Do I need penetration testing experience to use it?
No. Findings are ordered by severity and connected to the page where each issue was observed. Paid reports add practical remediation steps and configuration examples, while every result should still be verified before making a production change.