ProductChecks

We ask your app the questions a stranger would.

Anyone can try to open someone else’s order, change a price or download a backup. We ask your app 129 questions like that, in plain words.

Check my app See how apps get hurt

Are backups, database exports or folder listings reachable?
Can customers choose what they pay?
Can someone send email that claims to come from you?

Can anyone change or delete data without signing in?
Can strangers use your AI features on your bill?
Are secret keys written into your repository?
Are search engines told what they may list?

Can a request choose what your server runs?
Can your database tables be read without signing in?
Do customers who cancel keep paid access?

Can passwords and codes be guessed without limit?
Do secure pages load anything over an insecure connection?
Are admin panels or status pages open to anyone?
Can reset links or invite codes be guessed?

Can paid features be switched on without paying?
Can a request rewrite a database query?
Are secret keys or passwords in what browsers download?

Can signed-in users reach other customers’ records?Found

Can anyone tell your app a payment went through?
Is your domain registration close to expiring?
Can a link on your domain send visitors elsewhere?

Can users give themselves more rights?
Is your app running in development mode?
Can a request open files outside their folder?

Do passwords, keys or sign-in details end up in your logs?
Does your file storage list its files to anyone?
Do the libraries you install have known flaws?
Are passwords stored so they can be read or cracked?

Can files with passwords or keys be downloaded?
Can text your AI reads make its tools do harm?
Is the certificate valid, trusted and far from expiring?

Can anyone start your scheduled jobs?
Can people upload files without signing in?
Are keys or database dumps in the folder your site publishes?
Do your pages ask browsers to protect them?

Five ways an app gets hurt.

Customers can read each other’s data.

Orders/#10423MMia Klein

Order #1042 Your order

CustomerMia Klein

AddressKastanienallee 12, 10435 Berlin

Phone+49 160 4471 902

Items1 × Wool scarf

Total€48.00

Order #1043 Not your order

CustomerJonas Becker

AddressLindenstraße 4, 10115 Berlin

Phone+49 151 2208 4417

Items2 × Linen shirt

Total€86.00

High

Signed-in users can reach other customers’ records

SeenMia opened order #1043. It belongs to Jonas Becker.

WhereYour order page, line 14 of its code

WhyThe order is loaded by its number, and nobody asks whose it is.

See the fix

Someone pays less than they should.

Pro planBilled monthly

Pro plan, 1 seat€49.00

VATIncluded

Due today€49.00

Card•••• 424212 / 28

Total~~€49.00~~€0.01

Changed in the browser

Pay

€0.01 receivedPro plan unlocked

Critical

Customers can choose how much they pay

SeenThe checkout sent €0.01 and the payment went through.

WhereYour checkout, line 22 of its code

WhyThe price comes from the browser, not from your server.

See the fix

Strangers make your app work for them.

AI usage this month

$482

Nobody signed in · $441Signed-in customers · $41

+$1.92 from someone not signed in+$2.37 from someone not signed in+$2.73 from someone not signed inBudget passed on Oct 13

Oct 1Budget $50Oct 30

High

Strangers can use your AI features on your bill

SeenMost of this month’s AI requests came from nobody signed in.

WhereYour AI chat, line 9 of its code

WhyAnyone can call the feature, with no sign-in and no limit.

See the fix

Your site shows more than it should.

A stranger’s scanner

example.org/.envNot found
example.org/adminNot found
example.org/backup.sqlDownloaded · 48 MB

Inside backup.sql

MMia Kleinmia.klein@mail.de+49 160 4471 902

JJonas Beckerjonas.b@mail.de+49 151 2208 4417

SSara Nowaksara.nowak@mail.de+49 172 3390 115

AAli Demirali.demir@mail.de+49 176 8820 431

Critical

A database export is downloadable by anyone

Seenexample.org/backup.sql answered with a 48 MB database export.

Whereexample.org/backup.sql

WhyAnyone who asks for the address gets the file. No sign-in is needed.

See the fix

Secrets sit in your code.

example-org / shopPublic

.env

DATABASE_URL=postgres://••••••
Stripe payment keySTRIPE_SECRET_KEY=sk_live_••••••
SITE_URL=https://example.org

File deleted1 week ago · Remove .env

Remove .env1 week ago
New order page2 weeks ago
Add payment keys3 weeks ago

Still in the historySTRIPE_SECRET_KEY=sk_live_51N••••••

Critical

Secret keys are committed to your repository

SeenA live payment key sits in .env, committed three weeks ago.

WhereThe file .env, line 2

WhyAnyone who can read the repository can use the key.

See the fix

Watch a check run.

Your address9

Up and answering

Certificate

Redirect to https

Search listing

Domain renewal

Email in your name

Forgotten subdomains

Outdated encryption

Claimable subdomains

Your pages15

Browser protections

Script policy strength

Cookie protection

Shared cache sign-ins

Insecure content

Password forms

Exposed keys

Libraries on your pages

Hijacked script hosts

Raw HTML

Unpinned outside files

Framework version

Messages between pages

SVG images

Forwarding links

Left in public7

Published config files

Backups and open folders

Development mode

Keys in links

Password files

Admin tools

Storage file lists

Your API17

Who may call your API

Cookies for other sites

Who can reach which data

Where money can leak

Who your app believes

Sign-in token keys

Guessable codes

Signature checks

GraphQL schema

Password guessing

Session keys

Session cookie settings

Server Action origins

Links that change data

Sign-in with other services

Token trust anchors

Private cache owners

Your server17

Server request forgery

Command injection

Path traversal

Unsafe redirects

Who can spend your AI budget

Scheduled jobs

Keys in responses

Code injection

AI tools

Certificate checks

Secrets in logs

Image optimizer

Webhook senders

Search patterns

Enforced webhook verification

Nested object writes

Archive destinations

Your data15

SQL injection

Database search commands

Database row security

Sign-up settings

File storage

Database rules

Firebase database

Firebase rules

Password storage

Encryption strength

Database views

Database functions

Rules on editable fields

Sign-in records

Anonymous uploads

Your repository38

Vulnerable libraries

Committed secrets

Keys named for the browser

GitHub Actions

Environment in the bundle

Published folder

Infrastructure state

Malicious action releases

A container is configured to run in privileged mode

A container is configured to share the host network

A container is configured to share host processes

A container is configured to share host communication channels

A container is configured to mount a host container-engine socket

A container is configured to mount the host filesystem root

A container is configured to request broad system administration

A container is configured to run without a seccomp filter

A container is configured to run without AppArmor confinement

A container explicitly requests the root account

An S3 policy grants public object reads

An S3 policy grants public object changes

An S3 bucket configuration enables a public ACL

A security group permits worldwide administration ingress

A security group permits worldwide database port ingress

An RDS configuration requests a public address

An RDS configuration disables storage encryption

An RDS configuration disables automated backups

An IAM policy configuration grants unrestricted actions

An IAM role trust policy allows any AWS principal

A workflow job requests every available write permission

Pull request code can run on a self-hosted runner

npm certificate validation is disabled in repository configuration

An npm registry is configured over plain HTTP

A remote workflow step uses a mutable reference

An EBS template explicitly requests no volume encryption

An ElastiCache template disables transport encryption

An ElastiCache template disables storage encryption

A CloudTrail template switches off trail recording

A CloudFront template permits plain HTTP requests

Checking0 / 118

You decide how far we look.

Your address is enough to start. The more you let us see, the more of your report fills in.

What we checkedexample.org

Your website

Is the certificate valid, trusted and far from expiring?Clear
Are secret keys or passwords in what browsers download?Clear
Do forms send passwords unencrypted or in the address?Clear

Your website · one address away

Can anyone download files like .env or .git?Waiting
Are backups, database exports or folder listings reachable?Waiting
Are admin panels or status pages open to anyone?Waiting

Waiting: these checks run once the domain is confirmed.

Who can reach which data · in your code

Can anyone change or delete data without signing in?Not checked
Can signed-in users reach other customers’ records?Not checked
Can users give themselves more rights?Not checked

Not checked: these checks need access to your code, which comes with a plan.

Look up any question.

Every check is a question, and some answer more than one. Search all 129 of them, and open any to see what it means.

Search the questions

129 questions

A check tells you what it saw that day. Finding nothing doesn’t prove a problem can’t exist.

NextReports

See what your app shows to anyone.

Start with a free check. You don’t even need an account to see your score.

Check my app See plans