Secscan
Free plan · From $19/moActively maintained
not read yet
Use
- For
- Vibe coders and small teams shipping web apps built with AI tools like Lovable, Bolt, or Cursor
- Price
- Free plan · From $19/mopricing page, read Oct 26, 2026
- Activity
- Actively maintainedsite updated 5 weeks ago
- Runs as
- API
- Used for
- scan a live web app for exposed secrets and missing headers
- get a plain-English fix prompt for an AI coding tool
- monitor up to three sites for hourly grade changes
- Has an MCP server (1 in the registry)public registry →
- Publishes llms.txt, a file written for AI assistantssecscan.us ↗
Free plan · From $19/mo
- Certifications they stateCCPAprivacy policy ↗
- Privacy policy updated2026-09-30privacy policy ↗
- Security contactsecurity.txt
These are Secscan's own statements, read from its pages. We did not audit them. A line that is missing was not found on the pages we read; it does not mean the practice is absent.
- MCP serverus.secscan/secscanverified in the MCP registry
- Stateanswers, 12 toolschecked 2026-10-26
- Address to connectsecscan.us/api/mcp
This card as JSON, for your agent →
Each line is something a program found when it went looking: the registry entry, the server's own answer, a spec that parses. A missing line means we did not find it, not that it does not exist.
Figure and bar: visits/mo, estimate · year: online since
- #1
Lovable
Builds production-grade web and mobile applications from natural language descriptions.
198kActiveFree plan2023 - #2
UNPWNEDMCP · sign-in
Scans websites for exposed services, secrets, and vulnerabilities across browser, API, network, and code layers.
121ActiveFrom $9/user/mo - #3
SimplyScanMCP · open
Checks deployed sites made with AI coding tools for leaked credentials, unprotected database tables, injection flaws and slow page loads.
44ActiveFrom $14.99 per use - #4
TurboPentest
Runs automated penetration tests with AI agents and security tools, delivering auditor-ready reports with exploits and fixes.
24ActiveFrom $99/mo2024 - #5
Vibe Code Detector
Scans AI-generated code for security vulnerabilities, exposed secrets, and quality issues before launch.
12ActiveFrom $15 once - #6
StackShieldMCP · sign-in
Scans a running Laravel app from the outside for exposed debug tools, leaked config files and missing security headers, then alerts on changes.
12ActiveFrom $29/mo2025
Not it? Say what you need
betaThree tools from the Atlas for the job you describe, each with what fits and what does not.
No notes yet. What do you use Secscan for?
Sign in to leave a noteWhat is Secscan?
Scans a web application's URL for exposed secrets, missing security headers, and Supabase or Firebase rule exposure, returning a plain-English report. It is listed in the Atlas under Developer tools.
Who is Secscan for?
Vibe coders and small teams shipping web apps built with AI tools like Lovable, Bolt, or Cursor
How much does Secscan cost?
Secscan has a free plan; paid plans start at $19/mo, per its pricing page on 2026-10-26.
Is Secscan free?
Yes, Secscan has a free plan, per its pricing page on 2026-10-26.
Do people use Secscan?
Little sign of use.
Is Secscan still maintained?
Actively maintained: site updated 5 weeks ago.
Is Secscan safe?
We do not audit vendors. What Secscan publishes, read 2026-10-26: CCPA stated on its privacy policy.
How do I cancel Secscan?
In its own words (terms of service, 2026-10-26): “You can cancel at any time from Settings.”
What are alternatives to Secscan?
In Developer tools, by use: Lovable, UNPWNED, SimplyScan, TurboPentest, Vibe Code Detector, StackShield.
How we read a tool
No votes, no reviews, no vendor claims. Every week a crawler reads each tool's own site and a few public registries, and the words on the card are bands over what it read.
- Use: visits to the site (estimated), installs from npm and PyPI, presence in Chrome's usage report.
- Activity: the newest release on GitHub, npm or PyPI; the newest dated page on the site; open roles on a public jobs board.
- Price: the vendor's own pricing page, read with the date. A figure is printed only when it is on that page.
- The line and the use cases are written by us from the homepage, one tool at a time, and refused when they repeat the vendor's marketing.
How AI assistants read each site — the reading vendors ask us about — is on each tool's own visibility page.
How we read every tool → · By INITE Atlas Desk
Cookies
Before we count this visit
Analytics and ad measurement tell us which pages and which of our ads do their job: Google Analytics and Google Ads, the Meta pixel, Yandex Metrica, and one first-party id of our own. Nothing is stored until you answer, and declining changes nothing about the site.