What we check, and why it matters

Shypset runs 100+ non-intrusive checks on a URL. These are the ones that matter most for AI-built apps, explained without jargon. Public checks run on every scan; Verified checks run after you prove you own the domain.

1. 01
   Leaked API keys in your JavaScript bundle

   Secret keys shipped to the browser in your JS files. · Public

2. 02
   Exposed source maps: your original code, one click away

   Original frontend source published next to the bundle. · Public

3. 03
   Supabase table readable without login

   Tables your app uses that answer anonymous reads. · Verified

4. 04
   Missing or weak Content-Security-Policy

   No browser-side limit on which scripts can run. · Public

5. 05
   Email spoofing: SPF and DMARC for your domain

   DNS records that stop others sending mail as you. · Public

6. 06
   Exposed .env and other files that should never be public

   .env, .git and backup files served by your host. · Verified

Built with a specific tool? See guides by platform.