A scan report is only useful if you know what to do with it. I built Harbova's free scan, Vibe Check, to be readable by someone who has never heard the word "CORS" in their life, but it's worth walking through how to actually use it, since a list of findings can still feel intimidating the first time you see one.
What it actually checks
Paste in your app's live URL and it looks at what's reachable from the outside, the way a stranger would see it: whether a real API key or secret got left somewhere a browser can read it, whether basic security headers are missing, whether your .env file or .git folder is sitting there publicly downloadable, and a handful of similar exposure checks. No login, no account needed, and it runs in under a minute.
How to read what comes back
- Start with anything marked critical or high severity. That's an exposed key, a downloadable .env file, or something else that's actively usable against you right now, today, not theoretically.
- Medium and low findings, missing headers, a disclosed server version, matter too, but they're the seatbelts, not the open door. Fix the door first.
- If a finding mentions a specific file or key type, that's specific enough to go fix directly, rotate that exact key, remove that exact file.
- A clean result on the free scan means the outside-facing checks passed. It's a real, good signal, and it isn't the same as a full audit of your app's internal logic.
What to actually do with a critical finding
If it's a leaked key, rotate it immediately with whichever service issued it, that's the single most time-sensitive fix on the list. If it's an exposed .env or .git folder, that needs to come down from public reach right away, since it likely contains more than just what the scan happened to flag. Everything else can genuinely wait a day while you handle those two.
This isn't meant to replace a deeper look at your app's actual logic, who can access whose data, whether a workflow can be abused. It's meant to catch the loud, urgent stuff fast, the kind of gap that's actively exploitable the moment it exists, not just theoretically risky.
Related reading
- Q&A: My Free Scan Came Back Clean. Do I Still Need Anything Else?
- What Running Our Scanner on a Bunch of Real Live Apps This Week Actually Showed Me
- Myth: "My App Is Too Small to Be Worth Anyone Attacking"
Run the free scan on your app now. Under a minute, no account needed.
Scan my app free