Exposed secrets
Looks for high-confidence server-side credential patterns in public HTML and linked client assets. Public Supabase anon keys, Firebase web config, Stripe publishable keys and reCAPTCHA site keys are not labeled secrets.
Live URL scan · passive and read-only
Run the free Lite Check
A free security check for AI-built apps. Paste your app's URL and we look for the gaps AI coding tools most often leave behind: exposed secrets, missing protections, risky data-access setups. No signup.
What this check covers
- Exposed server-side credential patterns in public HTML and linked assets
- Security headers such as CSP, HSTS and framing
- Public data-layer markers that point to a row-level-security review
- HTTPS consistency and ordinary framework fingerprints
What it cannot prove
- Business-logic flaws or authenticated access issues
- Server-side code, exploit validation or active RLS testing
- That an application has no vulnerabilities
lyrashield / lite-checkPASSIVE
01Fetch only public browser assets
02Keep credentials out of results
03Separate signals from proof
04State every important limit
No login · no exploit payloads · no table queries · no active RLS test
What this check can tell you
Browser protections
Reads Content Security Policy, HSTS, MIME sniffing, framing, referrer and browser-permission headers. Missing headers are hardening gaps, not automatic proof of exploitation.
Data-layer signals
Recognizes supported public BaaS markers and explains why server-enforced RLS or security rules deserve review. It never queries a table or collection.
Transport and framework signals
Checks HTTPS and obvious mixed-content references, then records ordinary public framework fingerprints to help scope a deeper authorized review.
Questions about the free Lite Check
What does the LyraShield free security check look for?
It reads the public page, response headers and up to six same-origin JavaScript or CSS assets linked by that page. It checks for high-confidence secret patterns, baseline security headers, data-layer signals, HTTPS consistency and supported framework fingerprints.
Is the LyraShield Lite Check safe?
It is passive and read-only. It does not log in, send attack payloads, query databases, enumerate private paths, exploit a finding or actively test row-level security. Scan only apps you own or have permission to test.
Do you store my app data or exposed secrets?
The scanner does not persist page bodies, matched secret values or findings. Analytics receives only coarse funnel counters — never the target URL, the hostname or finding detail. A public scorecard contains aggregate counters only.
Does a clean Lite Check mean my app is secure?
No. A clean result means no surface issues were found in this limited, outside-only check. Business-logic flaws, authenticated access issues, server-side code and exploit validation require a deeper authorized assessment.