# Secscan (secscan.us)

Scans a web application's URL for exposed secrets, missing security headers, and Supabase or Firebase rule exposure, returning a plain-English report.

- Atlas card: https://inite.ai/en/atlas/secscan.us
- Site: https://secscan.us
- For: Vibe coders and small teams shipping web apps built with AI tools like Lovable, Bolt, or Cursor
- Categories: dev
- Use 0/100 · alive 87/100

## Used for

- scan a live web app for exposed secrets and missing headers
- get a plain-English fix prompt for an AI coding tool
- monitor up to three sites for hourly grade changes

## Price

- from 19 USD/month, free plan (read 2026-10-26 on https://secscan.us/#pricing)

## For developers

- MCP server: us.secscan/secscan (namespace; open on 2026-10-26, 12 tools)
- Read 2026-10-26

## MCP server, measured daily

Server: https://secscan.us/api/mcp, checked every day since 2026-10-27 (1 checks).

- Answered: measuring, 1 daily checks so far
- Median first answer: 108 ms
- Sign-in: none
- Context its tool definitions take: about 1726 tokens (12 tools)
- Tool definitions: A, 92/100
- Failing "params_described": 1 of 12 tools
- Failing "annotations": 5 of 12 tools
- Warning "open_writes": add_monitor
- Method: https://inite.ai/en/atlas/mcp/report

## Your data

- Certifications stated: ccpa
- Read 2026-10-26

---

Source: INITE Atlas, https://inite.ai/en/atlas/secscan.us. JSON: https://inite.ai/api/atlas/secscan.us. MCP: https://inite.ai/api/mcp (atlas_lookup).