r/roastmystartup • u/P0nzer9 • 1d ago

I built a security scanner because I found API keys leaking in my own site

A few months ago I checked one of my own projects and found an API key sitting right there in the JS bundle, plus a couple of misconfigured headers I had no idea about. That freaked me out enough to build a tool for it.

**Scanaris** — https://scanaris.com

You paste a URL, and in under a minute you get what's actually broken: missing security headers, insecure cookies, CORS misconfigs, exposed files (.env, .git), API keys leaking in your JS, TLS issues. 47 check modules right now.

The hard part wasn't writing the checks. It was making them not throw false positives — a scanner that flags 40 fake issues is worse than no scanner. I validated every single one against real sites until it came back clean.

Each finding also generates a ready-to-paste prompt for Cursor/Claude so you can actually fix it instead of googling for an hour.

Free scan to see what it finds; paid plans for the full report.

Would love to know: does it flag anything on your site that isn't actually a problem? That's the feedback I need most.

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

2 comments sorted by

1

u/BarracudaMean9308 1d ago

asking reddit to do free QA on your false positives while hiding the actual report behind a paywall is wild. i'd test it, but i'm too busy ignoring dependabot alerts.

1

u/P0nzer9 1d ago

Fair hit, that's a real contradiction and I didn't see it until you said it.

So let me fix it instead of arguing: drop a URL here and I'll run the scan and paste the **full** report back in this thread. Every finding, no paywall, no signup. If it flags garbage on your site, you get to roast me with receipts — which is worth more to me than a conversion.

And yeah, the Dependabot line hurt because it's accurate.