Free
A first look at your public app.
Production Check inspects a public app URL and its browser assets for observable risk signals. The report separates findings from expected public configuration and states what could not be checked.
- Price
- Free
- Input
- A public app URL
- You get
- Findings, evidence labels, and coverage
- Access
- No repository credentials required
What it checks
What is visible from a public URL
Each report states what was observed and what needs a deeper review.
Public credential signals
Known server-secret and private-key patterns in public assets. Detected values are not tested against provider APIs.
Expected public keys
Client-side configuration such as publishable keys, distinguished from server credentials.
Public integration references
Observable references to providers, tables, and endpoints that may need engineering review.
Browser asset coverage
The public pages and assets the scanner could inspect, with limits stated beside the findings.
Review priorities
Findings grouped as FIX NOW, REVIEW, or EXPECTED, with context for deciding the next step.
Who it is for
You, if any of this is true
- You have a publicly accessible app and want to inspect what its browser assets expose.
- You are preparing to launch and want a starting point for an engineering review.
- You need to distinguish expected client configuration from potential server-secret exposure.
- You want an initial report before deciding whether to commission a deeper review.
Report
What the output contains
Your report groups findings as FIX NOW, REVIEW, or EXPECTED. It includes supporting evidence labels, detected technologies, and a coverage summary so you can see the limits of the check.
Privacy
What the check accesses
The check uses public information. See the privacy policy for data handling and retention details.
- Access
- Public pages and browser assets
- Credentials
- No login or repository credentials required
- Stored report
- Sanitized findings and coverage information
- Report links
- Anyone with a shared report link may be able to view it
- Limits
- Private code, authenticated behavior, and database policies are not verified
FAQ
Frequently asked questions
Does this inspect my private repository?
No. Production Check inspects a public URL and public browser assets. A private code review requires a separately agreed scope and access.
Does a clear report prove the app is secure?
No. A public scan has limited coverage. Authentication, database permissions, payments, and server behavior can require deeper inspection.
Are detected keys tested?
No. The scanner identifies observable patterns without using them to call provider APIs.
What happens after the report?
Review the findings and coverage. You can request an Engineer Scope Review if you want help deciding what to inspect next.
Start
Check your public app
Start with the public URL of an app you own or are authorised to check.
Open Production Check to enter the URL and see the scan progress and report.
Open Production Check