See what your site exposes before someone else does.

Safeey runs 1,700+ checks against a domain you own — file exposure, leaked secrets, APIs, subdomains, TLS, headers — and returns a graded report with the exact fixes.

Start scanning How it works →

21 categories1,000+ file paths0 setup

Coverage

Your whole attack surface, in one scan.

The checks an attacker runs in their first hour — automated, graded, and explained.

File exposure

1,162 paths — .env, .git, backups, cloud keys, DB dumps.

Leaked secrets

API keys and tokens exposed in your JavaScript bundles.

API security

GraphQL introspection and unauthenticated endpoints.

Subdomains

Certificate-log enumeration and dangling-DNS takeover.

TLS & headers

Certificates, HSTS, CSP, and 60+ header checks.

Injection & redirects

Open-redirect, reflected-input, and CORS reflection.

Three steps

Prove ownership, then go deep.

01
Verify your domain
Drop a validate.md file with your token at your site root. Safeey checks it, so you only scan sites you control.
02
Run a full scan
1,700+ checks across 21 categories, a ~900-path file-exposure sweep, and subdomain enumeration.
03
Fix what it finds
Every issue is graded, explained in plain English, and paired with the exact remediation.

New · safeey-cli

Now check your code, too.

Safeey scans your live site from the outside. safeey-cli scans your source code from the inside — catching injection flaws, hardcoded secrets, and vulnerable dependencies before you ever deploy. It runs locally, so your code never leaves your machine.

Learn more →View on npm

$ npm install -g safeey-cli
$ safeey scan ./

  vulnerable.js
    CRITICAL  Command injection  :12:3
    HIGH      SQL injection      :8:10
    HIGH      XSS via innerHTML  :16:3

  Risk grade F (0/100)  ·  3 critical · 3 high

Pricing

Start free. Upgrade when you're ready.

Scan for free. Pay only when you need the full picture and automatic fixes.

Free

$0/forever

safeey-cli — scan your code locally, unlimited
One free preview scan per site you verify
Security grade + your top finding
Plain-English fixes for what's shown

Get the CLI

No card required.