The Exact List Harbova's Free Scan Checks First, Written Out Plainly

I'd rather publish the actual list than describe it in vague terms and let people guess. Here's precisely what Harbova's free scan, Vibe Check, looks for the moment you paste in a live URL.

Exposed secrets

It checks whether a real API key or credential, for services like Supabase, OpenAI, Anthropic, Stripe, AWS, Google, GitHub, Slack, Twilio, SendGrid, or Resend, or a raw private key block, is sitting somewhere a browser can read it directly.

Exposed files and folders

• Whether your .env, .env.local, or .env.production file is publicly downloadable.
• Whether your .git folder is reachable, exposing your full commit history.
• Whether a config.json file with sensitive-looking fields is publicly readable.
• Whether a .DS_Store file, and whatever it reveals about your file structure, is exposed.
• Whether your source maps are exposed, which can make your original, unminified source code downloadable.

Security headers and transport

• Whether your site is actually served over HTTPS.
• Whether HSTS is set, so browsers are told to always use a secure connection.
• Whether a Content-Security-Policy exists.
• Whether clickjacking protection is in place.
• Whether X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers are set.
• Whether your server is disclosing its exact software version in its response headers.
• Whether CORS is configured openly to any site, especially alongside credentials.
• Whether cookies are set with the basic safety flags they need.

What a clean result actually means

A clean scan means none of the above turned up anything, which is a real, good, checkable result. It means the outside-facing surface of your app looks solid on this specific list. It doesn't mean your database's access rules are correctly scoped, or that one logged-in user can't reach another's data, since none of that is checkable without actually logging in and testing the app's internal logic, which is exactly what Deep Audit is built to cover.

Why I'm publishing the exact list instead of keeping it vague

A security tool that won't tell you what it actually checks is asking you to trust it blindly. I'd rather you know precisely what a clean result covers and what it doesn't, so you can decide for yourself whether that's enough for where your app is right now, or whether it's time for a deeper look.

Related reading

• Q&A: My Free Scan Came Back Clean. Do I Still Need Anything Else?
• What Running Our Scanner on a Bunch of Real Live Apps This Week Actually Showed Me
• Myth: "My App Is Too Small to Be Worth Anyone Attacking"