Scan your own site, not a rival
AuditHQ’s deep security scan runs on the website you own. It is off for homepage quick scores, compare, and competitor URLs.
Create a website project, run an audit, and open the Security panel. Free plans see counts and one header example. Pro and Company unlock the full redacted report.
Keys and tokens in the browser
The scan reads page HTML, up to eight same-origin JavaScript bundles, and request URLs already observed on that load.
It looks for Stripe live secrets, AWS access key ids, Google browser keys (AIza), OpenAI and Anthropic keys, GitHub tokens, Slack and Twilio credentials, database connection strings, JWTs, and service_role or service-account markers.
A Google browser key that is not restricted (HTTP referrers + API list) should not be public at all. Restrict it in Cloud Console, then rotate if it was unrestricted. Firebase and Maps keys may stay in the client only after that lock is on.
A match is stored as type plus last four characters only. Rotate the credential at the provider first, then remove it from the client bundle, then proxy the call through a server route.
Headers, cookies, and transport
Check the document response for Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, HSTS, and clickjacking protection (X-Frame-Options or CSP frame-ancestors).
Session cookies should carry HttpOnly, Secure, and SameSite. Missing flags are listed with the cookie name, not the cookie value.
Debug leftovers and abuse posture
Published sourceMappingURL comments in production bundles hand over original source. A reachable /.git/HEAD usually means repository history is downloadable — rotate every credential that was ever committed.
If the page already called a same-origin /api/ or .json URL, AuditHQ re-reads that URL once. It records CORS wildcards and whether RateLimit-*, X-RateLimit-*, or Retry-After appeared. It does not flood the endpoint.
Verify after you ship
Fix the listed artifacts, then re-run the project audit. The Security score and finding list should move. Copy the AI fix prompt on the project page when you want a file-level remediation plan from the same redacted evidence.