Projekt Studio
MenuClose

Free passive scan

Check what your app is leaking

Paste your app's address. This reads the page and the JavaScript it hands to a browser — the same bytes any visitor already downloads — and tells you what is visible from outside.

Passive read · Nothing probedNo account · No report kept

Packages

One is free. Two are the other half.

The scan above shows what a visitor's browser can find. The reads cover what it cannot: your rules, your server, your history. Both are done by a person, with your permission, and come back as a link.

  1. Passive scan

    What a browser can see, in thirty seconds.

    Freeno account, no email

    • Headers, cookies, source maps and exposed keys on any URL you own
    • Public keys told apart from secret ones, so nothing cries wolf
    • A design read of up to three screenshots, one finding in full

    Cannot see your database rules, your server, or whether one user can reach another's rows.

    Run a scan

  2. Repository read

    most bought

    The half a scan cannot see.

    $499one repository, one report

    • Read-only access through a GitHub collaborator invite; nothing is stored
    • Credentials in the tree and in the history, row level security on every table, known advisories, the build flags
    • Four reads by Claude, one question each, then three sentences on the whole thing
    • A report at a private link, with a path, a line and a fix for every finding

    A read, not a rewrite. You get the list and the reasons; the fixes are yours to make.

    Within three working days

  3. Full review

    The read, then the fixes, then a call.

    $1,499one repository, fixes included

    • Everything in the repository read
    • The critical and warning findings fixed in a pull request against your repository
    • A second read after the merge to confirm each one is closed
    • A sixty-minute call to walk through what was found and what to watch

    Fixes cover what the read found. New features and redesigns are separate work.

    Within ten working days

Payment is by card through Stripe. After paying you add a read-only collaborator to the repository and say where the report should go; nothing is read until you have. A read that finds nothing worth fixing is refunded in full.

How a read goes

Pay, invite, receive.

  1. 1

    Pay

    Card through Stripe. You land on a page that asks for the repository and an email; nothing is read before that page is filled in.

  2. 2

    Invite

    Add the audit account to the repository as a read-only collaborator. That is the whole of the access: no tokens of yours, no deploy keys, nothing installed.

  3. 3

    Receive

    The report arrives as a private link: a path, a line and a fix for every finding, and three sentences on the whole thing. Revoke the invite when you have read it.

Limits

What the free scan cannot see.

A scan from outside reads what a browser is handed. These four need somebody in the code, and are what the reads are for.

  1. 1

    Whether your database rules actually hold

  2. 2

    Whether signed-in users can reach each other's data

  3. 3

    Anything that happens on your server

  4. 4

    Whether a sign-in can be brute-forced

The limits, in full

Questions

What do you get access to?

Read access to one repository, through a collaborator invite you send. Nothing is cloned to disk; the tree is fetched, read, and dropped with each step. Revoke the invite whenever you like.

What if nothing is found?

A read that turns up nothing worth fixing is refunded in full. The report still comes, and says so.

Is the free scan really free?

Yes. No account, no email, no report kept. It exists so you can see what this is before paying for the half it cannot do.

Who does the reading?

One developer, with Claude for four narrow reads that a person then checks. The findings carry a path and a line number so you can check them too.

Projekt Studio

Passive scan · no report kept

See the packages