Machina Totalis
Free app scan

Scan your app

Paste the URL of an app you own. One read-only pass checks for secrets in the bundle, open database tables, missing headers, and exposed paths, then ranks what it found by how much it can hurt you. Nothing is stored.

  • Read-only
  • Under thirty seconds
  • Nothing is stored

Read-only. Under thirty seconds. Nothing is stored.

Machina scanReady

Waiting for a URL

Reads the page, its scripts, a few known paths, and public database tables, read-only. Looks for leaked keys, a service-role token, missing security headers, open CORS, exposed .env and .git, and Supabase tables readable with the public key.

What it checks

The problems apps built fast tend to ship

Apps built fast, especially with AI app builders, tend to ship the same handful of problems. Owners rarely know until someone else finds them.

  • 01

    Keys in the browser bundle

    Secrets embedded in the scripts your page loads.

  • 02

    A service-role key exposed to users

    The one key that bypasses every rule in your database.

  • 03

    Tables any visitor can read

    Supabase tables that answer to the public key.

  • 04

    Missing security headers

    The headers browsers use to block common attacks.

  • 05

    Open CORS

    APIs that answer requests from any site.

  • 06

    Exposed .env and .git

    Environment and git files left public.

Read-only, by design

It proves as little as it needs to

An early version read a real row to show a table was open; the shipped version reads nothing and only checks whether the table answers. Acceptable-use terms went live before the route did.

  1. 01

    Scan only what is yours

    You must own the site or app, or have written permission from whoever does. By running a scan you confirm that, and you are responsible for it.

  2. 02

    It writes nothing

    It sends the ordinary requests a browser sends when it loads a page and its scripts. It writes nothing, changes nothing, and does not sign in as anyone.

  3. 03

    It is not a penetration test

    It finds a specific list of common problems and misses everything else. A clean grade does not mean your app is secure.

  4. 04

    Nothing is stored

    We store nothing from a scan unless you ask us to email you the results.

Codebase rescue

An app that works in a demo and worries you in production. We make it boring.

Inherited or AI-built app that is not ready for real users? We review the code, rank what can hurt you, and fix it, keeping what works.

Send us the repoCodebase rescue