No account required
Free security scan for an app you own
Paste a public URL. FlowCheck requests the page, same-origin scripts, a few well-known paths, and response headers. You get a 0–100 score, plain-English findings, and a prompt a coding agent can apply. It does not submit forms, guess passwords, or write data.
What the scan looks for
- Stripe secret keys, OpenAI keys, and Supabase service_role keys in public JavaScript
- Whether common Supabase tables answer a read-only request with only the anon key
- HTTPS, HSTS, clickjacking protection, and the other headers generated apps forget
- A public .env file or a source map that includes your original source
- CORS that reflects an unrelated site
What it does not do
- It is not an attack. It only reads what the app already published.
- If it finds a Supabase anon key, it asks for one row from common tables and stops. It does not insert or update.
- A failed check is a point-in-time reading, not a guarantee the app is safe.
- Scan only applications you own or are allowed to test. The scanner terms cover the rest.
Keep the signup path under a schedule
The scan is a one-time look at the public surface. Monitoring reruns signup, login, or checkout once a day, and on Starter and Pro after a deploy. A real failure emails you the screen and a fix prompt.
Monitor a flow