External exposure analysis

See what your app reveals to attackers.

Give us a public URL. Lockvane reads the pages, delivered code, and configuration any visitor already receives, then reports what an attacker could do with it, ranked by what to fix first.

NO ACCOUNTNO PAYLOADS SENT~90 SECONDS
0
payloads sent to your app
6
passes over what you already serve
2×
reproduction before we call it confirmed

What we look at, stated plainly

No credentials. No agents. No traffic your users wouldn’t generate.
LV-01
Delivered code
Every JS and CSS file a browser downloads, unminified and searched for keys, tokens, internal endpoints, and debug paths.
LV-02
Configuration
Response headers, cookie flags, CORS, TLS, and cache directives measured against current baseline guidance.
LV-03
Authentication surface
Sign-up, reset, and session endpoints read for rate limits, enumeration, and token handling, with no credentials used.
LV-04
Data reachability
Public API routes and storage buckets checked for what an unauthenticated request actually returns.
LV-05
Third-party posture
Supabase, Firebase, Stripe, and analytics integrations verified for key scope and policy enforcement.
LV-06
Attack narrative
Findings chained into the shortest realistic path from a stranger on the internet to your customer data.

Severity is assigned, not guessed

Every finding carries a level and a weight, and the exposure index is the sum of the weights of what is still open. Anything we could not reproduce twice is marked OBSERVED, never CONFIRMED, and an observation counts half.

LevelMeansWeight
CRITICALReachable now, no authentication, direct access to data or funds46
HIGHRequires a step or a condition, but leads to the same place24
MEDIUMMaterially weakens a defence or widens an existing hole11
LOWInformation disclosure and hardening gaps4
Evidence attached to every finding
GET /assets/index-4f9c.js
  -> 200 · 412 KB · text/javascript

  line 1, col 84210
  const SUPABASE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6..."
  decoded: { "role": "service_role", "exp": 2051222400 }

  reproduced 2/2 · unauthenticated · no headers set
CWE-798OWASP A07REPRODUCED 2/2FIX ATTACHED
Read-only by design
We never send payloads, write data, or authenticate as you.
Ownership before depth
Anything that queries your database needs proof you control it.
Reproduced or downgraded
A finding we could not observe twice is reported as OBSERVED, never CONFIRMED.
Revoke at any time
Disconnect here or at the provider. Access ends on the next check.

You pay for the work, not for the app

Connecting is always free. Adding an app has never been the billable event.
Free$0

Enough to find out whether you have a problem.

  • Unlimited public scans, no account
  • Connect every project and repository you have
  • The full findings table and the fix for each one
Pro$29/mo

Always-on protection for everything you have connected.

  • Continuous monitoring, with alerts when something new appears
  • Weekly security digest
  • One-click fixes on GitHub and Supabase
  • Fair-use deep scans included
Deep scan pack$4.99 once

For occasional checks and one-off client audits.

  • 10 deep-scan credits
  • Redeem any time within 12 months
  • No subscription

A deep scan is one reachability run against one verified project. It queries your database, which is why it is metered and why the public scan never is. Card payments run through Stripe, and MonCash is available if you are in Haiti.

Find out in ninety seconds.
First report free. Nothing to install, nothing to authorize.