Built your app with AI? Verify it is safe and secure before launch.
AI-built apps often miss critical headers, TLS rules, and DNS policy. Audit 12 controls and get a ready-to-paste fix prompt.
Inspect Your Live Domain or Staging URL
Zero-Payload Passive AuditLive TLS, HTTP, cookie, and email DNS telemetry
Paste directly into any AI coding assistant or agent
Blocks private RFC1918, loopback & cloud metadata
Block unsafe deployments before they reach users
Passive Security Control Catalog
Every finding is derived from live, non-intrusive TLS, HTTP, and DNS observations. Unsupported checks are explicitly disclosed so you know exactly what is verified.
HTTPS Availability & TLS Certificate Validation
TLSHandshakes port 443, verifies the X.509 certificate chain, CN/SAN hostname match, and days remaining until expiration.
HTTP-to-HTTPS Redirect Enforcement
HTTPVerifies that plaintext port 80 requests redirect cleanly to HTTPS within 3 hops without open-redirect exposure.
HTTP Strict-Transport-Security (HSTS)
HeadersAudits max-age duration (180+ days baseline), includeSubDomains coverage, and browser preload readiness.
Content-Security-Policy (CSP)
HeadersDetects missing CSP headers, unsafe-inline or unsafe-eval script directives, and frame-ancestors clickjacking defenses.
X-Content-Type-Options (MIME Sniffing)
HeadersEnsures nosniff is enforced on document responses so browsers cannot execute disguised MIME payloads.
Referrer-Policy Configuration
HeadersVerifies strict-origin-when-cross-origin or stricter policies to prevent sensitive URL token leakage.
Permissions-Policy (Browser Features)
HeadersAudits browser capability restrictions across camera, microphone, geolocation, and payment APIs.
Session & Auth Cookie Security Attributes
CookiesInspects Set-Cookie headers for Secure, HttpOnly, SameSite, and __Host- / __Secure- prefix enforcement.
Server & Runtime Version Disclosure
HeadersFlags verbose Server and X-Powered-By headers that expose underlying framework or container versions.
Public DNS Resolution & CAA Policy
DNSResolves A, AAAA, NS, and Certificate Authority Authorization (CAA) records restricting unauthorized TLS issuance.
Sender Policy Framework (SPF)
EmailVerifies v=spf1 TXT records and flags missing policies or permissive +all spoofing vectors.
DMARC Email Authentication Policy (_dmarc)
EmailAudits _dmarc TXT policy enforcement (p=reject or p=quarantine vs unauthenticated p=none).
[selector]._domainkey) when a selector is provided.Sign In to Run Live InspectionSimple, Transparent Plans
Start free to audit your AI-built app before launch, or upgrade for continuous monitoring, CI/CD gates, and team seats.
Indie Starter
For solo builders checking an AI-built app before launch.
- Up to 5 live domain inspections per day (30 / month)
- 12 passive security checks + optional DKIM verification
- Universal AI Fix Prompts & multi-stack config generators
- 1 weekly scheduled monitor & 1 CI/CD API key
- Single-user workspace with 7-day report history
Launch Pro
Most PopularFor founders shipping production AI apps with continuous monitoring and CI/CD gates.
- Up to 100 domain inspections per day (1,500 / month)
- 10 daily or weekly monitors with TLS & regression alerts
- 10 developer API keys for automated post-deploy CI/CD gates
- Outbound alert webhooks (Slack, Discord & custom HTTPS)
- 3 team workspace seats & 90-day report diff history
Studio Team
For studios and engineering teams securing multiple client and production deployments.
- Up to 500 domain inspections per day (10,000 / month)
- 50 scheduled monitors with instant regression telemetry
- 25 developer API keys across multi-repo pipelines
- 10 team seats with role-based access (Owner, Admin, Dev, Auditor)
- 365-day compliance retention & immutable security audit log