ScanMySaaS field guides
Fix the surface your customers can see.
Practical guides for the checks that repeatedly matter in SaaS websites, source repositories, deployment workflows, and databases. Each one explains what the signal means, what to verify, and how to ship a safer change.
Security headers for SaaS: what to add first
A practical guide to CSP, HSTS, clickjacking protection, MIME sniffing, referrer policy, and permissions policy for SaaS teams.
SSL and TLS checklist for a production SaaS
Check certificate trust and expiry, HTTPS redirects, HSTS, mixed content, cookies, and redirect chains before they become incidents.
robots.txt and XML sitemaps for SaaS websites
Configure robots.txt and XML sitemaps without leaking private routes or accidentally blocking the public pages that should rank.
llms.txt for SaaS: useful file, realistic expectations
What an llms.txt file can communicate, what it cannot guarantee, and how to publish a concise version for a SaaS product.
Exposed files and source maps in production
Find and remove public environment files, Git metadata, backups, debug pages, and JavaScript source maps from a SaaS deployment.
GitHub secret scanning for vibe-coded apps
What to do when an AI-built app commits an .env file, API key, database URL, private key, or service credential to GitHub.
GitHub Actions security for vibe-coded apps
Review workflow token permissions, pull_request_target, secret handling, third-party actions, and release jobs before an AI-generated workflow reaches production.
Supabase security for vibe-coded apps
Protect a Supabase app with Row Level Security, correct key placement, tenant-aware policies, storage rules, and server-only administrative access.
Want the checks applied to your own site?
Run the public scanner, then use the affected URLs to work through the right guide.