Web Scanner — What we check

The Web Scanner performs the following checks on every scan. All checks are run against publicly accessible data only — we never attempt to access authenticated content.

TLS / HTTPS

Certificate validity, expiry date, and TLS protocol version. We flag expired certificates, certificates expiring within 30 days, and deprecated protocol versions (TLS 1.0, 1.1).

Security headers

Presence and value of Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Missing or misconfigured headers are flagged.

Cookie flags

All Set-Cookie headers are checked for Secure, HttpOnly, and SameSite attributes. Cookies without these flags on a production HTTPS site are flagged.

CORS policy

Overly permissive Access-Control-Allow-Origin: * responses, especially on endpoints that also set cookies or return sensitive data.

AI key detection

Patterns matching OpenAI, Anthropic, Mistral, and other LLM provider API key formats in HTML source, inline scripts, and JavaScript bundles. Also checks for Supabase anon keys in client-side code (these are public by design, but flagged as a configuration reminder).

Open cloud endpoints

Publicly accessible Supabase tables, Firebase databases, and S3 buckets referenced from the page source.