Try a Ship Read

Paste your live URL. Seatbelt reads what your site serves any visitor, then hands you a report that says which of the seven risk surfaces it could reach from out there, and which it could not.

Your live site

Outside view: what any visitor can see in the served page and scripts. Not a pentest.

Nothing deployed yet?

Read one of our sample apps instead. Same engine, same report.

A URL read sees what your site serves any visitor. Login, payments, customer data and code execution live in your repo and backend, where a URL cannot reach. For all seven surfaces, run it on the source:

$ npx withseatbelt