hackymacky

hackymacky

Know what your public site leaks.

Paste a URL. We check client bundles for secrets, including Neon connection strings, and probe anon Supabase permissions and unauthenticated Neon Data API reads.

94 security scans run

Opt-in · domain verify for deep scans · fingerprints only · no row dumps

How it works

Live

What ships today.

Paste a URL for a preview. Claim the domain for the deep sweep. The free tier is the product.

  • Preview

    Paste a URL

    Secrets in the client bundle, including Neon connection strings, plus what a Supabase anon key or an unauthenticated Neon Data API can reach. No account.

  • Claim

    Deep probes

    After domain verify: storage, RPC, anon writes, and auth posture — plus a copy-paste fix on every finding.

  • Score

    Score and history

    A 0–100 on every scan, a sparkline, a diff vs the last full scan, and owner triage that survives rescans.

  • Daily

    Rescans and mail

    Verified projects rescan every day. The project page shows what changed overnight. Score drops and new highs can email you or post to Slack — titles only, never secrets.

  • Badge

    Public score badge

    Opt-in SVG for READMEs and sites. Score only. Findings stay private.

  • Report

    Shareable report

    Tokenized Markdown and PDF. Remediations, not plaintext secrets or row dumps.

  • CI

    Optional CI gate

    GitHub Action that can fail a job on critical — or high. Public URL. Accessory glue, not the product.

  • MCP

    scan_url + report

    stdio for Cursor and Claude. Preview needs no login. Deep findings use a dashboard API key or a share token.

Looks for

  • sk_live_… Stripe live key
  • service_role JWT in client bundle
  • postgresql://…@….neon.tech in client JS
  • Anon can list tables via OpenAPI
  • AKIA… AWS access key id
  • Anon can list REST resources
  • -----BEGIN PRIVATE KEY-----
  • Anon can list storage buckets
  • Public storage bucket / object listing
  • Anon can reach dangerous RPC
  • Anon INSERT / UPDATE / DELETE
  • Open signup / anonymous sign-in
  • Anon can read public profile tables
  • api_key = '…' in client JS
  • sk-… OpenAI API key
Built for
Next.jsSupabaseNeonVercel

Claim

Prove the domain, unlock the deep scan.

One DNS TXT record or one file. Either is enough. We do not scan storage, RPC, or anon writes until you verify.

DNS TXT

Name @

hackymacky-verify=a91f4c7e2d8b6035f1c4e9a7b25d80f3

File

/.well-known/security-scan.txt

Token on one line. Serve 200, no redirect.

Your token is generated when you add the project. The sample above is not a real one.

Claim a domain

Next up

Not shipped

Parked

  • GitHub PR comments
  • Teams
  • Pricing UI
  • Agent undo / quarantine
  • AEO beyond blog JSON-LD