Security scorecard
Score 100/100 · 0 failed · 0 warnings · 10 passed · 1 not applicable
Scanned 2026-10-22 12:13 UTC in 10.5s · 16 requests · 51 scripts · Detected: Next.js, Cloudflare
Checked 52 HTML/script sources for Stripe (sk_live_, rk_live_, whsec_), OpenAI, Anthropic, Supabase service-role / sb_secret_, Resend, AWS, GitHub, Slack, SendGrid and private-key secrets. Publishable keys were ignored.
Heuristic match = a string in your public JavaScript/HTML looks like a secret (likely, not verified). Confirmed = directly observed in an HTTP response (e.g. a header is absent, a file's contents were validated). All checks are passive and read-only; secrets are stored redacted to their first 6 characters. A good grade is not a guarantee of security.