.env and credentials
Flags committed environment files and high-confidence provider, database, and private-key patterns.
Free website vulnerability scan. No card required.
SaaS security scanner before your next launch.
Shipping with Cursor, Claude, Codex or Lovable? Run a free website vulnerability scan on your deployed app. Find exposed files, unsafe headers and risky cookies, with affected URLs and a clear order for what to verify first.
Free scan, no card. Free account to see the full report. One fix included.
60+ checks Up to 25 pages Readable report
Example report
64
Needs attention
8 pages checked
app.acme.test
3 example findings · illustrative score
Environment file is publicly accessible
Critical/.env
Public source map reveals application code
Medium/_next/static/chunks/app.js.map
Session cookie readable by JavaScript (no HttpOnly)
Medium/login
Prioritized remediation is readyView fixes →
Product demo
Watch a real scan.
Watch the walkthrough, then run a scan on your own public URL. The report sorts findings by severity, shows the page where each was found, and adds a readiness check for the TLS certificate, robots.txt, sitemap and llms.txt.
Real product flow·No installation required
60+
vulnerability checks
25
pages per scan
40+
sensitive paths probed
1
free first scan
Built with Codex, Claude, or Cursor?
Scan the code before the public app.
The website scanner sees what reached production. The repository scanner checks your public or private GitHub repository for committed environment files, secret patterns, risky GitHub Actions, exposed client keys, Supabase tables created without row level security, and unsafe build settings. Each finding comes with a fix prompt you can paste into your coding agent.
Read-only GitHub App you control. No clone, package install, build, or code execution. Public repositories are free; private repositories are included in Starter and Pro.
GitHub Actions
Reviews token permissions, pull_request_target usage, secret output, and mutable third-party actions.
Supabase boundaries
Looks for service-role exposure and migrations that create tables without visible RLS enablement.
Client and build risk
Checks public secret prefixes, wildcard CORS, raw HTML sinks, eval, and production source maps.
The report
Findings sorted by severity, each with the page it came from.
Start with the affected URL and a prioritized finding. The free report includes one actionable fix when available; paid plans add remediation for the remaining issues.
Create free account01
Full-site vulnerability scan
Crawl up to 25 reachable pages so the assessment covers more than the homepage.
02
Prioritized security findings
Separate critical and high-risk issues from medium, low, and informational signals.
03
Affected URLs preserved
Keep every finding connected to the exact page where the scanner observed it.
04
Step-by-step remediation
Try one actionable fix in the free report. Paid plans unlock the remaining remediation steps and configuration examples.
05
Saved scan history
Return to earlier reports without losing the context behind previous findings.
06
Rescans and score trends
Run a fresh scan after a release and track whether the security score improves over time. Free accounts get one verification rescan within 7 days; later rescans use credits.
scanmysaas.com/scan/…Sample report
SaaS security field guides
Guides for the findings you will see.
Each one explains why a finding matters, how to fix it in a typical Next.js, Vercel or Supabase setup, and how to confirm the fix.
6 min read
SaaS launch security checklist for vibe-coded apps
Check tenant isolation, Supabase RLS, sessions, Stripe webhooks, and public exposure before your SaaS launch, with a find, fix, and retest worksheet.
Read guide4 min read
Vibe coding security checklist: 47 checks before you ship
A practical vibe coding security checklist for apps built with Lovable, Cursor, Bolt, Claude Code or Codex: secrets, auth, ownership checks, Supabase RLS, payments, headers and what you can automate.
Read guide5 min read
Supabase security checklist for vibe-coded apps
Supabase security checklist for Lovable, Bolt, Cursor or Claude apps: RLS, table grants, publishable vs secret keys, storage, edge functions and tests.
Read guide2 min read
GitHub secret scanning for vibe-coded apps
What to do when an AI-built app commits an .env file, API key, database URL, private key, or service credential to GitHub.
Read guide2 min read
Security headers for SaaS: what to add first
A practical guide to CSP, HSTS, clickjacking protection, MIME sniffing, referrer policy, and permissions policy for SaaS teams.
Read guideHow it works
How does a SaaS security scanner work?
Start with a URL, let the automated scanner inspect the public surface, then use the report to decide what to verify and fix first.
STEP 01
Point us at your app
Enter a public URL you own or are authorized to test.
STEP 02
We inspect the surface
The crawler discovers pages and checks observable security signals.
STEP 03
Work down the risk
Open the report, address priority findings, then run a fresh scan.
From URL to verification
Submit an authorized URL, crawl up to 25 pages, run 60+ checks, review findings and affected URLs, confirm and fix with your coding tool, then rescan.
Security coverage
What the SaaS security scanner checks on your live app.
ScanMySaaS runs 60+ automated checks on what is publicly reachable. It does not log in, send attack payloads, or replace a human security review. Just need the website check? Use the free website vulnerability scanner.
SSL & transport
SSL/TLS use, HTTPS redirects, HSTS, mixed content, and downgrade risks.
Security headers
CSP, framing protection, MIME sniffing, permissions policy, referrers, and more.
Exposed files
Public environment files, Git metadata, backups, logs, source maps, and debug paths.
Cookies & forms
Secure, HttpOnly, and SameSite flags plus observable CSRF protection gaps.
Client-side risk
Unsafe DOM sinks in inline scripts (innerHTML, document.write, eval), old jQuery, AngularJS 1.x and Bootstrap 3 builds, and third-party scripts without integrity hashes.
App exposure
Technology leakage, debug endpoints, GraphQL introspection, DNS and email signals, and CORS.
AI discovery
llms.txt availability and a readable public resource map for compatible AI tools.
Crawl readiness
robots.txt, XML sitemap, canonical URL, homepage indexability, and security.txt.
Your first scan is free
Know what your launch left exposed.
No credit card. Use it on a website you own and keep the report.
Vulnerability scanner FAQ
SaaS security scanner FAQ
What is a SaaS security scanner?
A SaaS security scanner checks a software-as-a-service product for security problems an attacker could find from the outside or in its code. ScanMySaaS scans the deployed website (headers, cookies, exposed files, TLS and more) and, separately, the GitHub repository behind it (committed secrets, risky GitHub Actions, missing database rules, vulnerable dependencies and, on paid plans, an AI review of authorization logic).
What is the difference between the website scan and the GitHub repo scan?
The website scan only sees what is publicly reachable on your deployed app. The GitHub repo scanner reads your source code, public or private through a read-only GitHub App, and finds issues an outside scan cannot see, such as committed .env files, API keys in code and unsafe GitHub Actions, with the exact file and line. On Starter and Pro, an AI review also looks for missing ownership checks in server code. Use both: scan the code before launch and the live site after each release.
How do I scan a SaaS application for security vulnerabilities?
Enter a public URL you own or are authorized to test. ScanMySaaS crawls up to 25 reachable pages, runs more than 60 automated website vulnerability checks, and returns a prioritized report with severity, affected URLs, and finding descriptions.
What types of vulnerability does the scanner detect?
SSL and HTTPS problems, missing or weak security headers, risky cookie flags, exposed environment, Git and backup files, CORS that reflects untrusted origins with credentials, redirect problems (no HTTP to HTTPS redirect, HTTPS downgrades, long redirect chains), public source maps, old jQuery, AngularJS or Bootstrap builds, unsafe inline JavaScript, and missing SPF or DMARC records. It does not send attack payloads such as SQL injection or XSS tests.
Is the SaaS security scanner free?
Yes. Your first scan is free, requires no credit card, and can inspect up to 25 reachable pages. The free report includes the security score, severity breakdown, affected URLs, finding descriptions, and one prioritized fix when an actionable finding is available. A free account keeps the report and gives you one free rescan of the same site within 7 days, with a list of what was fixed and what is new. Paid plans add a fix for every finding and monthly credits for more scans.
How is ScanMySaaS different from Burp Suite or Nikto?
ScanMySaaS is designed as a quick, browser-based outside-in check for SaaS founders and product teams. It requires no installation or command line, but it is not a replacement for Burp Suite, Nikto, manual penetration testing, or a professional security review.
Do I need penetration testing experience to use it?
No. Findings are ordered by severity and connected to the page where each issue was observed. One actionable finding includes free remediation steps when available. Paid reports unlock the remaining fixes. Verify each finding and proposed change before applying it to production.