Scan any HTTPS site free — create an account, verify your domain, then get your score.
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Built for vibe-coded apps
Ship without surprises.
Create a free account, verify your domain, and get your security score in minutes.
HTTPS URLs only · Free account · Verify domain ownership before scanning
Already have an account? Sign in
57
security checks
Finds the vulnerabilities your AI assistant ships — and never flags.
A–F
grading
Plain letter grade so you know your risk before you ship.
<60s
results
Paste a URL and get a full report in under a minute.
0
installs
No CLI, no GitHub app — verify your domain and start scanning.
What we check
The security gaps AI
assistants leave behind.
Critical
Supabase RLS not enabled
Tables without Row Level Security expose all user data via the public API.
Critical
Stripe webhook unverified
No signature check means anyone can fake a payment and trigger order fulfillment.
High
Server action without auth
Next.js server actions that mutate the database without checking the session.
High
Missing ownership checks
Update and delete operations that don't verify the record belongs to the caller.
Medium
Insecure cookie flags
Cookies set without Secure, HttpOnly, or SameSite=Strict attributes.
Medium
Error message leakage
API routes that return error.message, leaking file paths and table names.
How it works
From zero to secured
in under a minute.
01 — CONNECT
Connect your project
Paste your GitHub repo URL, your live site URL, or both. No installs, no tokens required.
Your site URL
https://my-saas-app.vercel.app
Scan now →
02 — SCAN
Watch the scan run
Our engine checks your code for secrets and auth gaps, and probes your live site for misconfigurations.
Scanning…73%
✓ Checking auth routes
✓ Supabase RLS policies
· HTTP headers…
✓ Supabase RLS policies
· HTTP headers…
03 — FIX
Ship the fixes
Every finding explains the risk and hands you a copy-paste code snippet. No security background needed.
Score 54/100Grade D
RLS disabledCRITICAL
No CSP headerHIGH
→ View fix guide
Your security report
Plain English.
Not a CVE dump.
Every finding tells you what the vulnerability is, what an attacker could do, and exactly how to fix it — written for builders, not security researchers.
- —Security score from 0–100 with a letter grade
- —Findings sorted by what matters most right now
- —Copy-paste code fixes you can ship in minutes
- —Separate code scan and live site scan results
Security Report
my-saas-app.vercel.app · Grade D · 9 findings
54/100
3
Critical
2
High
1
Medium
3
Low
0
Info
Supabase RLS disabled — users can read all rowsCritical
Stripe webhook has no signature verificationCritical
/api/seed returns 200 in productionCritical
Server action writes to DB without authHigh
Missing Content-Security-Policy headerHigh
Built for the vibe-coding stack
Next.jsSupabaseVercelStripePrismaClerkOpenAIResendTailwindshadcn/ui
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
http→https redirect: 301
checking response headers...
Permissions-Policy: camera=()
mixed content: none
exposed admin route: not found
rate limit headers: present
scan complete · score 54 · grade D
$ repofort scan --type full
repo + live URL · parallel workers
correlating findings across surfaces
priority queue: 2 critical · 5 high
report generated · 34 checks passed
$ repofort scan --repo github.com/acme/saas-app
cloning repository...
analyzing 47 source files
grep: API_KEY — 0 matches in src/
grep: sk_live — 0 matches
auth middleware: session check passed
server action: ownership validated
checking headers...
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: nonce validated
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
CORS: origin allowlist configured
cookie: HttpOnly · Secure · SameSite=Strict
RLS probe: table users — policy enforced
RLS probe: table orders — tenant scoped
open redirect: none found
path traversal: blocked
secrets scan: .env not tracked ✓
scan complete · score 78 · grade B
$ repofort scan --url https://myapp.vercel.app
dns resolve: 142ms
tls cert: valid · TLS 1.3
Don't ship
unsecured.
Paste your URL above — we'll create your project, guide you through domain verification, and run your first scan automatically.
No install · Results in 60s · Plain English reports