All 33 StackSecured scan engines, explained

Passive parsing of JS bundles, HTML source, DNS records, and headers. Zero data mutation, read-only requests, included in every scan without pre-verification — including the free tier.

Attack Probe (XSS / SQLi / Auth Burst)

Fires real offensive XSS and SQLi payload injections alongside authentication-endpoint request bursts against live targets. Strictly gated behind domain ownership to prevent misuse as a free attack proxy.

Authorization (BOLA / IDOR)

Tests ID-bearing routes (e.g. /api/orders/123) and discovered admin routes for unauthenticated access. Does not claim full cross-user BOLA testing, which would require faking multi-tenant identities.

Supabase RLS (Row Level Security)

Attempts unauthenticated SELECT queries against every discovered table to test whether RLS policies genuinely block read access. Deliberately read-only — never mutates data or exposes row contents in reports.

SSRF Detection

Discovers URL-fetching endpoints (image proxies, link previews) and probes them with canary targets like cloud metadata IPs and file:// URLs to detect internal network exposure.

Webhook Signature Verification

Sends spoofed webhook payloads — e.g. a fake "payment succeeded" event — with deliberately wrong or missing signatures to confirm whether the endpoint enforces cryptographic signature verification.

File Upload Authentication

Dispatches multipart POST requests with no attached files to upload endpoints, verifying that authentication gating happens before payload processing — without ever storing files on target systems.

API Key Exposure

Scans client JS bundles for private secrets — OpenAI, Anthropic, Stripe secret, Supabase service-role keys. Ignores intentional public keys (Supabase anon, Stripe publishable) to prevent false alarms.

Config File Exposure

Probes paths like .env, .git/config, and wp-config.php. Uses response fingerprinting rather than status codes alone to prevent false positives from SPA fallback pages.

Next.js Data Leak (__NEXT_DATA__)

Parses the JSON hydration blob embedded in Next.js HTML for server-side secrets, database connection strings, and personal data accidentally passed directly to the client.

Firebase Security

Detects Firebase client configs in page source and tests unauthenticated read access against Firestore, Realtime Database, and default Storage buckets to catch unconfigured security rules.

CORS Configuration

Sends spoofed origin headers to detect wildcard, reflective, or credentialed CORS misconfigurations that let external sites read authenticated response data.

Security Headers

Evaluates HSTS, CSP, and X-Frame-Options on the homepage, with automatic retry logic to eliminate false alarms caused by server cold-start delays.

Admin Route Exposure

Probes sensitive backend API endpoints (e.g. /api/admin, /api/users) while deliberately ignoring page routes that safely redirect to a sign-in screen.

GraphQL Security

Probes GraphQL paths for unauthenticated introspection (full schema leakage) and tests whether query batching is enabled, which can be used to bypass per-request rate limits.

Cookie Security

Parses live Set-Cookie response directives to confirm session tokens enforce HttpOnly, Secure, and proper SameSite attributes.

Source Map Exposure

Audits production Next.js build paths for exposed .js.map files, which let an external actor reconstruct original, unminified source code.

API Documentation Exposure

Checks standard Swagger/OpenAPI paths and verifies response content signatures to flag publicly accessible API documentation that maps internal endpoints.

HTTP Method / TRACE

Dispatches low-level TCP/socket TRACE requests directly, bypassing a Node fetch() runtime restriction that silently fails to detect TRACE exposure on standard engines.

Error Disclosure

Triggers error conditions to check for leaked stack traces, framework versions, or raw database error messages (Prisma, Postgres).

Open Redirect

Tests parameters like redirect, next, and url against spoofed domains to catch unvalidated redirects that get used in phishing campaigns.

Auth Rate Limiting

Fires a burst of concurrent requests at auth endpoints (/login, /signin) to verify credential-stuffing throttling is actually enforced, not just configured.

JWT / Session Security

Decodes tokens found in cookies and client storage; flags alg:"none" exploits, missing expiry, and session tokens stored somewhere they shouldn't be.

Active Probe (debug endpoints)

Safely checks for publicly accessible debug and diagnostic endpoints without needing domain verification. Its offensive counterpart — real XSS/SQLi payloads — is gated separately as the verified-only Attack Probe engine above.

AI-Code Risk (beta)

A static-pattern scan built specifically for code generated by LLM assistants — looking for client-side-only authorization checks and direct client-side database mutation calls with no server gate behind them. Findings are capped at Medium severity and phrased as advisory, because an unauthenticated scan can't prove intent, only surface a pattern.

Business Logic Signals

Flags observable client-side business logic anomalies worth human review — like client-controlled pricing fields, or quantity inputs that accept negative numbers. Explicitly low-confidence: it surfaces what's worth a second look, not a confirmed exploit.

Technology + CVE Lookup

Fingerprints your tech stack and queries OSV.dev and curated CVE databases. Assigns full severity only when a version number is actually confirmed, never guessed.

Wayback Machine Exposure

Queries the Internet Archive's CDX API for archived secret files — .env, git config — that may still sit in permanent public history even after you've removed them from your live site.

Email Security (SPF / DMARC / DKIM / DNSSEC)

Resolves DNS records at the apex domain — never www. — to verify your email anti-spoofing coverage, and that each record is actually valid, not just present.

TLS Certificate Expiry

Opens a raw HTTPS connection to inspect the SSL/TLS peer certificate's expiration date directly, with handling to avoid crashing on connection errors.

Subdomain Takeover

Matches CNAME records against known abandoned third-party provider signatures (GitHub Pages, S3, Vercel) to flag dangling hosts an attacker could claim.

SEO Signals

Audits traditional search fundamentals — titles, meta descriptions, Open Graph tags, canonical tags, mobile viewport configuration — and robots.txt syntax, to catch an accidental Disallow: / blocking every crawler.

AEO — Answer Engine Optimization

Evaluates the structured data (JSON-LD, FAQ schema, HowTo schema) and verified contact pages that conversational AI engines like ChatGPT and Perplexity look for before citing a product directly in an answer.

GEO — Generative Engine Optimization

Checks the entity trust signals — Organization schema, Person/founder schema, linked social profiles, privacy and terms pages — that LLM-powered search models weigh when deciding whether to recommend a brand at all.