passive security & quality audit for sites built with ai

Built by AI.
Audited by us.

Paste the URL. We check what your AI builder left exposed — secrets, headers, known-vulnerable dependencies, and more — before someone else finds it first.

What we check

54 checks in 9 groups, every one of them running today — including real headless-Chromium rendering for contrast, Core Web Vitals, and keyboard focus.

headers

Browser security policy
- Content-Security-Policy present
- X-Frame-Options / clickjacking
- HSTS on HTTPS sites
- X-Content-Type-Options, Referrer-Policy, Permissions-Policy
- Cookie flags — Secure, HttpOnly, SameSite
- CORS misconfiguration (wildcard + credentials)
- Mixed content on HTTPS pages
transport

TLS and certificates
- HTTPS enforced, not plain HTTP
- Outdated TLS protocol (1.0/1.1/SSLv3)
- Certificate validity and expiry window
secrets

Exposed keys and files
- AWS, Stripe, Google, GitHub keys in the page or JS bundles
- .env, .git/config, backup.sql reachable
- OpenAI, Anthropic keys in the page or JS bundles
- Supabase / Firebase project exposure / rules reminder
- Source maps (.map) reachable in production
exposed surface

Admin/debug endpoints
- wp-admin, wp-login, /graphql
- phpinfo, server-status, actuator/health
- Directory listing enabled
- Verbose error / stack-trace pages
- Unbranded default 404 page
dependencies

Known-vulnerable JS libraries
- Every detected library version matched against OSV.dev's public advisory database
platform

AI-builder fingerprint
- Lovable, Bolt.new, Replit, v0, Base44 signatures
- CMS/framework version disclosed in generator tag
- Tailwind's Play CDN left in production
- Unmodified component-library defaults
accessibility

DOM-detectable issues
- Images missing alt text
- Missing page language, heading skips
- Form fields with no label
- Focus outline removed with no replacement
- WCAG AA contrast — real rendered-color measurement
- Visible change on keyboard focus — real rendered check
performance

Static page-weight signals
- Total page + linked asset weight
- Missing gzip/brotli compression
- Render-blocking scripts in <head>
- Images missing width/height (CLS risk)
- Core Web Vitals — real LCP and CLS, measured in Chromium
content

Basic hygiene
- robots.txt, sitemap.xml present
- Sensitive paths hinted in robots.txt
- Title, meta description, Open Graph tags
- Favicon, viewport meta, charset declared
- Leftover placeholder text (Lorem ipsum, etc.)

Why Plat.one

Free, no account

Every check, every time — nothing held back behind a sign-up form or a paywall.

Real CVE matching

Detected JS libraries are checked against OSV.dev's public vulnerability database — not a placeholder "dependencies" tab.

MCP server included

Audit a site straight from Cursor or Claude Code — plat.one/mcp, free, no key.

MCP tool-poisoning check

Building or connecting to MCP servers? Scan one for prompt-injection and tool poisoning — same free, no-login model.

Honest about limits

A passive scan can't test auth depth or database access rules — we say so in the FAQ, instead of implying a clean score means "secure."

Why this matters now

AI coding tools — Lovable, Bolt.new, Replit, v0, Base44 — let anyone ship a working app in an afternoon. What they don't do is check what got exposed along the way. A generated app can go live with an open .env file, a default admin panel, or missing security headers, and nobody notices because there was no step in the process that would have caught it. Plat.one is that missing step.

How Plat.one works

You give us a URL. We run a passive scan — the same kind of requests any visitor's browser already makes. No login, no code execution, nothing installed on your site. Within moments you get a plain list of what's actually public: exposed secrets, open endpoints, missing headers, weak configuration.

FAQ

What does this tool actually check?+

It fetches your homepage and up to 15 same-origin CSS/JS files it links to, over plain HTTP(S) — no login, no code execution on our side. It checks security response headers, TLS/certificate health, whether common sensitive files (.env, .git/config, backup SQL dumps) are publicly reachable, whether any API keys or tokens are visible in the page or its JS bundles, a best-effort probe of common exposed admin/debug paths, a DOM-detectable subset of accessibility issues, static page-weight/compression, and basic content hygiene (robots.txt, sitemap.xml, viewport, charset).

Is it safe to run on a live site?+

Yes — every check is a normal GET/HEAD request to something the site already serves publicly. We never attempt to log in, submit forms, or write anything to your site.

Do I need to own the site I'm scanning?+

You should only scan sites you own or are authorized to test. We ask for that confirmation before running a scan, and log the time and address it was requested from.

Does a clean result mean the site is secure?+

No. This is a capped, passive, best-effort scan — it can't test authentication depth, database access rules, or business logic. Treat a clean result as “no obvious issues in what a scanner can see from the outside,” not a certification.

Why does this exist?+

AI coding tools (Lovable, Bolt, Replit, v0, Base44, or just Cursor/Claude Code) make it fast to ship a working app — and just as fast to ship one with an exposed .env file or a database with no access rules. This is a free first pass before you find out the hard way.

Built by AI.Audited by us.

Why this matters now

How Plat.one works

Built by AI.
Audited by us.