Scanners read your source code. But incidents happen in what you deployed — API keys shipped into the browser, database credentials and dumps anyone can download, APIs with no auth. We look at the deployed reality. And we write down even what we couldn't verify.
Sources: Escape.tech — State of Security of Vibe Coded Apps (2025, ~1,400 apps, 2,038 critical vulns) · Veracode 2025 GenAI Code Security Report (100+ LLMs) · industry figures, not measurements of your app
We scan nothing until you prove you control the domain. Not an "I agree" checkbox — a proof only you can produce. No one can enter your domain and have it scanned.
SSH internal audits run only with a separate explicit request and granted access. Results go to you alone and are never published. Any secrets found are kept as fingerprints only — the originals are not stored.
HOW IT WORKS
The second step — proof of consent — is what makes this service safe.
Enter the web app's address and we issue a unique token bound to your request alone.
Place the token at /.well-known/star365-audit-consent.txt or add it as a DNS TXT record. Being able to put it there is itself proof that you own the domain.
We audit only after verifying the token. Pass, fail (warn/critical) — and the items we couldn't verify — all in a tamper-proof receipt.
TRY IT
The real audit runs on our server, but you can walk through the request and token flow right here.
WHAT WE CHECK
This list is generated from what the audit engine declares — not typed by hand. If the engine changes, this table changes with it. Each item gets one of three verdicts: pass, fail, or undetermined.
Does the site respond. If we cannot read it, we judge nothing else.
reachableWhether API keys or other secrets ship inside the HTML and JS delivered to browsers.
client_secretsWhether a public source map (.map or inline data-URI) lets your original source be reconstructed from the bundle — even with no secret in the bundle, pricing logic, internal flows and comments are exposed. This is what external reverse-engineering targets.
source_mapsWhether paths like .env or .git are reachable from outside.
exposed_pathsWhether the four main security headers such as CSP and HSTS are set.
security_headersWhether missing URLs return 200 — machines then read typo URLs as real pages.
soft_404Whether cookies on an https site are missing Secure — they can leak over a plaintext request.
cookie_flagsWhether robots.txt blocks this public page from every crawler. Having no robots.txt is fine.
robots_sanityWhether the HTML served without running JavaScript already has content — crawlers and link previews do not run JS.
server_rendered_bodyWe open it in a real browser and watch for console errors.
runtime_errorsWhether scripts, images or other assets fail to load.
broken_assetsWhether an https page pulls http resources.
mixed_contentWhether real content paints — a 200 can still be a blank screen.
renders_contentWhether narrow screens get a horizontal scrollbar.
mobile_overflowWe follow internal links to see whether they actually open.
internal_linksWe measure font size and contrast on the rendered page — 12px minimum, WCAG AA (4.5:1 body, 3:1 large). If the background cannot be determined we do not judge.
readabilityWhether the public page calls localhost or private IPs — a dev API address left in the build fails for every visitor.
private_network_callsWhether common API paths hand out user records (email, phone…) without login — checked with GET only, values never stored.
open_api_dataIf the bundle ships a Supabase URL and anon key, it tries one GET per table the bundle already calls, using the anon key, to see whether RLS is on. Row values are never read; only column names are.
supabase_rlsChecks whether the Server and X-Powered-By headers or a generator tag reveal a version string such as nginx/1.24.0. A version is not itself a flaw, but it hands attackers a shortlist. We do not judge whether it is vulnerable.
version_disclosureSAMPLE REPORT
A real audit example. Not just the passes — we also write down what we couldn't see and what to fix.
WHY US
Snyk and Semgrep's free tiers are excellent. But they read your source code.
FAQ
So that people and AI answer-engines read the same answers, we keep the common questions right here.
Not the source code — the deployed reality. API keys shipped to the browser, databases open from outside, unauthenticated APIs — and we also open it in a real browser to catch console errors, broken assets, mobile horizontal overflow and dead links. The failures that happen after you deploy, seen from outside.
Not with a checkbox, but with proof. We issue a token; the audit begins only once you prove ownership by placing it at a designated path on the domain or as a DNS TXT record. We re-verify right before scanning.
External audits use read-only GET requests only. No injection, no brute force, no overload. The result receipt is kept as a tamper-evident hash chain.
Each verdict is one of pass / fail / undetermined, and failures carry a severity (warn/critical). We never fold an unread item into a pass or a zero — we write down even what we couldn't verify.
External audits are free. If you like, voluntary donations (non-custodial: USDT, USDC, BTC, ETH, BNB) are welcome. SSH internal audits and continuous monitoring are arranged after a consultation, based on scope.
Related: Request an audit · llms.txt · Operator star365 · Trading fleet metaquant · Sitemap
IF THIS HELPED
External audits are free. If you need a deeper check, or this helped, leave a signal — that's what keeps this service going.
SUPPORT
External audits are free. If it helped, a voluntary donation keeps this service going (optional). Non-custodial — straight to a wallet.
🔴 Send only on the network shown — a wrong chain means permanent loss. Below the minimum is lost too.
Donations go to a star365 exchange account · USDT, USDC, BTC, ETH, BNB supported