Exactly what we read
- Your home page and the settings it sends to browsers (called response headers).
- Up to 6 of your own code files (JavaScript files) linked from the home page.
- 4 private files that should never be public: your settings files (
.envand.env.local) and your code history (.git/HEADand.git/config).
That’s all. It makes the same kind of requests a browser makes when someone visits your site.
What we warn you about
- Secret keys visible in your page or its code files: for example a Supabase service_role key, a Stripe secret key, or an OpenAI or Anthropic API key. Reports show only part of each key.
- Missing browser settings (security headers), 6 of them: always use https, where scripts and files may load from, blocking other sites from embedding yours, stopping browsers from guessing file types, how much of your page address other sites see, and which browser features stay off.
- Private files anyone can download, such as
.envor your.gitfolder. - Public keys that are fine to show, such as the Supabase anon key, are listed as information, not as a problem.
Example results
| Finding | What it means |
|---|---|
| Critical: OpenAI key in /assets/index.js | Anyone can copy the key and use your OpenAI credit. Ask your AI tool to move this key out of the page and into a backend function, so visitors can’t see it. |
| Medium: No Content-Security-Policy | The browser will run scripts from any source on your page. |
| Info: Supabase public key is visible | That’s normal. Your database rules decide what this key can read. In Supabase they’re called Row Level Security (RLS). |
Security watch on paid plans
This page describes the security checks in the free scan. When you add a site to Heedza, paid plans also get Security watch. Every time we check your site, we look at it from the outside, like a visitor, and tell you in plain words when something is exposed or changes. Every alert comes with the exact fix to paste into your AI tool.
| What we alert you about | Plans |
|---|---|
| Exposed files and backups. We look for about 25 well-known files that should not be public, such as database backups, zip backups of your site, settings file copies, phpinfo pages and log files. We tell you when one can be opened by anyone. The Free plan and the free scan check 4 common files. | Solo and up |
| New outside scripts on your homepage. We alert you when your homepage starts loading a script or frame from a website we have not seen on your site before. You choose “It was me” for tools you added, or “Get a fix prompt” if you did not. | Solo and up |
| Unexpected redirect. We alert you when your homepage starts sending visitors to a different website. | Solo and up |
| Security setting dropped. We alert you when your site stops sending a security header (a setting such as the one that tells browsers to always use https) that it sent the last time we looked. | Starter and up |
| Old server software notice. When your site shows which version of PHP (the software some sites run on) it uses, we tell you if it is old and what to ask your host. Many hosts hide the version, and some fix problems without changing the number, so this is information, not a verdict. | Every plan |
| More code files read for exposed keys. We read up to 15 of your own script files for secret keys, instead of 6. | Pro and Business |
| Google’s list of potentially unsafe sites. Once a day we ask Google’s Web Risk service whether Google’s list currently flags your site as potentially unsafe. If it does, we alert you with what Google says and a fix prompt. We do not find this ourselves, and a site that is not on Google’s list can still have problems. Not part of the free scan. | Every paid plan |
The free scan stays as it is. Free plans keep checking the same 4 files. The free scan does not use Google’s list.
What it doesn’t do
- It’s read-only. It doesn’t fill in forms, guess passwords or send attack traffic, so it’s not a full security test (penetration test).
- It can’t see your database rules, so it can’t tell whether your public Supabase key can read your tables.
- It reads your home page and up to 6 of its code files, so a key used only on another page may not be found.
- We check from the outside. We cannot see inside your server, so we cannot tell if its software is up to date or if someone left hidden files that are not public.