What we check

OpenAI and Anthropic API keys

Anyone can copy them from DevTools and run up your AI bill.

Stripe secret and restricted keys (live and test)

A live secret key lets someone issue refunds, read customers and move money.

Supabase service_role JWTs and sb_secret_ keys

These bypass Row Level Security, giving full read/write access to your database.

AWS access key IDs and secret access keys

Leaked AWS keys are found and abused by bots within minutes.

GitHub tokens (ghp_, gho_, github_pat_ …)

They can grant access to your private repositories.

Slack tokens

They let someone read or post in your workspace.

Private keys (e.g. Google service account PEM keys)

A private key in client code is full account access.

Firebase / Google API keys

Usually public by design, but flagged (low) so you can confirm they're restricted by domain and API.

Generic hard-coded secrets (api_key, client_secret, access_token = "…")

Catches keys from services we don't have a specific rule for. Obvious placeholders and Shopify's public Storefront tokens are ignored.

Content-Security-Policy (missing, or allowing unsafe-inline scripts)

A CSP is the main defence that stops injected scripts (XSS) from running.

Strict-Transport-Security (missing, or max-age under 6 months)

HSTS stops browsers from ever trying insecure HTTP, blocking downgrade attacks.

X-Frame-Options or CSP frame-ancestors

Without one, other sites can embed your page in an iframe and trick users into clicking (clickjacking).

X-Content-Type-Options: nosniff

Prevents browsers from guessing file types and executing something as script.

Referrer-Policy

Stops full URLs, which may contain tokens or IDs, from leaking to third-party sites.

Permissions-Policy

Lets you switch off camera, microphone, geolocation and other features you don't use (informational).

X-Powered-By

Advertising your stack and version helps attackers pick exploits (informational).

CORS: Access-Control-Allow-Origin * with credentials

Lets any website make authenticated requests on your users' behalf.

Page served over plain HTTP

Logins, cookies and traffic can be read or changed on public Wi-Fi.

http:// doesn't redirect to https://

Visitors who type your domain may land on an insecure version.

Redirect chains longer than 2 hops

Each hop adds latency before your page even starts loading.

Mixed content (http:// scripts, images, iframes or styles on an https page)

Browsers block or warn about them, which can break the page.

Error status (4xx/5xx) on the scanned URL

The page you're about to share isn't actually reachable.

Cookies missing the Secure or HttpOnly flag

Session cookies without them can be stolen over plain HTTP or via XSS.

<title> missing, very short, or longer than 70 characters

Your title is the headline in search results and browser tabs.

Meta description

Without one, Google improvises a snippet that usually converts worse.

Open Graph tags (og:title, og:description, og:image)

Links shared on X, LinkedIn, Slack and iMessage show a bare URL instead of a preview card.

Viewport meta tag

Without it the page won't scale on phones, and mobile rankings suffer.

lang attribute on <html>

Helps screen readers and search engines understand the language (informational).

Canonical URL

Stops duplicate URLs (www vs. non-www, query strings) from splitting your ranking (informational).

<h1> heading

Search engines use it to understand what the page is about.

Page that's nearly empty without JavaScript

Many crawlers and preview bots don't run JS, so a client-rendered app can look blank to them.

noindex robots meta tag

Tells Google not to index the page — a common leftover from staging.

robots.txt (missing, or blocking all crawlers with Disallow: /)

We only read the rules for all user agents (User-agent: *), so blocking a single bot isn't flagged.

sitemap.xml (or a Sitemap line in robots.txt)

Helps search engines discover all your pages faster.

Server response time (over 1.2s, or over 3s)

Slow HTML delays everything else; many visitors bounce after a few seconds.

JavaScript weight (over 600 KB, or over 1.5 MB)

Heavy bundles take seconds to download and parse on mid-range phones.

HTML document over 500 KB

Often caused by inlined data or SVGs that could be cached separately.

Gzip/Brotli compression on the HTML

Uncompressed responses are 3–5x larger over the wire.