detektd.
Study20% of breaches start with an exploited vulnerability · Verizon DBIR 2025

Secure your web app.We see what you can't.

The security scanner for web applications. 190+ checks from the outside: exposed secrets, open APIs, CVEs, TLS, DNS and configuration. In 2 minutes, a score, findings ranked by severity and the fix for each one.

Create accountSee a report

Free · no access to your database · zero install

Adapts to your stack:
Next.jsReactVueNuxtAngularSvelteAstroRemixLaravelDjangoWordPressShopifyFirebaseSupabase
01Detections

Everything an attacker would see before you.

Four families of flaws, spotted from the outside on any stack, before an attacker stumbles on them.

Secrets in your frontend

Stripe, OpenAI, AWS or database admin keys shipped in your JavaScript: anything your frontend sends, anyone can read.

Data reachable without login

APIs, databases or file storage that answer without checking who is asking. Emails, orders, invoices: all readable.

Forgotten files and consoles

A .env, a .git repo, a backup or an admin panel left online: the full map of your app, handed to an attacker.

Known flaws and misconfig

Vulnerable versions of your framework or dependencies, missing security headers, overly permissive CORS and cookies.

Copy-paste fix

Every flaw ships with its fix. Copy, paste, done.

Never modifies anything

The Scan starts from your URL and reproduces everything an attacker can see, without ever writing or modifying anything. Scan Pro goes further with active tests that modify (write tests, uploads, CSRF, RPC, rate-limit) via a test account, once you've proven the domain is yours.

02How it works

From link to fix, in three steps.

  1. 01

    Paste your URL

    Your app's public address is enough. No login, no API key, no agent to install.

  2. 02

    We scan in 2 min

    We reproduce what an attacker would do: secrets, APIs, exposed files, vulnerable versions. Without ever modifying anything. Scan Pro pushes the tests further, on a domain you've verified.

  3. 03

    Report + fix

    A score out of 100, flaws ranked by severity, and the fix for each one.

03The report

Clear, ranked, fixable.

Not an unreadable report. An attack dashboard, with the fix one copy-paste away.

  • 1
    Security score

    Critical. Fix before any production release.

  • 2
    Flaw breakdown

    Every finding ranked by severity, with exactly what it exposes.

  • 3
    Fix: exposed key

    The steps and the code to paste, fitted to your stack.

app.demo-shop.com
Security report
Critical
2
Critical
0
High
1
Medium
CRITStripe secret key exposed in the bundle
Fix
# revoke the key, then keep it server-side- NEXT_PUBLIC_STRIPE_SECRET_KEY=sk_live_…+ STRIPE_SECRET_KEY=sk_live_…
CRITOrders API readable without login
MEDMissing security headers
scan completed in 1 min 52 sno access required
04The state of things
0%
of breaches start by exploiting a vulnerability
Verizon DBIR, 2025
0%
of secrets leaked in 2022 (API keys, tokens) are still valid two years later
GitGuardian, 2025
0%
of private repositories contain plaintext secrets
GitGuardian, 2025
0min
to find out where yours stands
Average detektd scan

A web app can pass every test and still ship with a door left open. Not through negligence, but because nobody looked at it from the outside.

detektd sees it. Before anyone else.
05Pricing

Free to start.

One scan a week, no credit card. Move to Pro or Studio when you want continuous coverage.

See full pricingCreate account
06FAQ

The questions that keep coming up.

07Our commitment

Security, no strings attached.

  • No admin access, ever requested
  • 100% external scan, like an attacker
  • None of your database data stored

Create your account in 30s, free. Your scan starts right after.

Create account
detektd: security scanner for web apps