Free check

Is your app safe to launch? Find out in ten seconds.

A free, passive check of your headers, cookies, exposed files and leaked keys. No login, no signup, nothing behind your login is touched.

  • We only request what any browser would. We never log in, submit forms or test your database.
  • We don't keep your URL or your result, only counts. If you ask for the report by email we keep that copy 30 days, then delete it.
  • Built by Unflatline. Site owner and don't want to be checked? Email hello@unflatline.com and we add your domain to the block list.

What it checks

Two views of the same app.

Anyone can see the browser view. The owner view looks a little deeper, so it needs a quick proof that the site is yours.

Browser view · anyone

What a page load shows.

  • HTTPS redirect and HSTS
  • Security headers: Content Security Policy, framing, nosniff, referrer and permissions policies
  • Cookie flags: Secure, HttpOnly, SameSite
  • The stack we recognize, such as Supabase, Next.js or Vercel

About ten requests to your homepage, the same ones a browser makes. Nothing a stranger couldn't see by opening the page.

Owner view · after a sign-in link

What sits next to it.

  • Files that should not be public: /.env, /.git/HEAD, /.DS_Store
  • Source maps published next to your scripts
  • Strings shaped like secret keys in your public code
  • Passive reads for Supabase and Firebase that any anonymous visitor could make
  • Paste-ready config for your platform, for every Fix

Prove control with an email at your domain, a DNS TXT record or a small file. Owner checks then run for 24 hours.

Guides

Fix it yourself.

Plain guides for the things the check looks at, with snippets for each platform.

Security headers

What each header does, the five that matter, and the config for Vercel, Netlify, Cloudflare, Next.js and nginx.

Read the guide →

Exposed env files

Why /.env and /.git end up public, how to test your own site, and what to rotate.

Read the guide →

Supabase RLS

Why the anon key is public by design, what Row Level Security does, and the two-user test.

Read the guide →

Ship Safe Check

The parts a passive check can't see.

Database rules, auth settings, storage policies and edge functions are where most Supabase and Firebase breaches happen. The Ship Safe Check, $290, covers them by hand, with your written authorization, in 3 business days.

Book the Ship Safe Check See a sample report →

Unflatline, operated by Atarus Offensive Security LLC. hello@unflatline.com