Scan your site before you launch it. One check covers the things that slip through on launch day: API keys in your JavaScript, a public .env or .git folder, source maps, weak security headers, mixed content, a forgotten noindex, and missing titles, share tags and favicon. It is free, and nothing you scan is stored.
How to scan your site, step by step
- Type your site's address in the address box.
- Press Scan site and wait a moment.
- Read the results. Use the tabs to see All checks or one category: Files and secrets, Security, Search and sharing, or Basics.
- Fix what is flagged, deploy, and scan again to confirm.
What the scan looks for
Exposed files and secrets: API keys, tokens and private keys inside your HTML and scripts; public .env, .git and config.json files; and source maps that publish your original code. Security: HTTPS and the redirect from plain HTTP, the main security headers, cookie flags, mixed content and a security.txt contact. Search and sharing: the title, description and Open Graph tags, robots.txt, sitemap.xml and any noindex left over from staging. Basics: the viewport, page language, favicon, and links to a privacy policy and terms.
What happens when you scan
This tool makes network requests, so here is exactly what it does. Snowkit's server fetches your homepage, robots.txt, sitemap.xml, security.txt, favicon, up to 5 of your own scripts and their source maps, and 4 common leak paths. That is 30 requests at most, with no crawling. The keys and tags are checked in your browser, and nothing is stored. Please scan only sites you run or have permission to test.
If a key turns up
Treat it as leaked, even if the site is not public yet. Revoke or rotate it with the provider first, then move it out of front-end code into a server-side environment variable or a backend function. Keys meant for browsers, such as publishable payment keys or restricted map keys, are fine to ship, but lock them to your domain in the provider's dashboard.
What it cannot see
It checks the homepage and the files it links to, not every page. Content that only appears after JavaScript runs, pages behind a login and server-side code are not visible to it. A clean scan means the common launch mistakes are covered, not that the site is fully secure.
A simple launch checklist
- Run the scan on the real address, not a draft link.
- Remove any noindex left from staging.
- Add a title, description and share image to each key page with the meta tag generator.
- Publish a sitemap with the sitemap generator and a privacy page with the privacy policy generator.
- Check your own code with the secret scanner before you deploy.
Questions
Can I scan any site?
Only scan sites you run or have permission to test.
Does it store my results?
No. Nothing you scan is stored.
Is a clean result a guarantee?
No. It covers common launch mistakes on the pages it can see, not every possible weakness.