Security scanners
AmIHackable
Paste a public URL and get an outside-in report on exposed files, secrets in JavaScript, headers, TLS, and similar issues, plus a prompt for your AI tool.
Pricing as seen
Scan and full report listed as free while V2 is rebuilt. Future paid monitoring: See site.
Checked 16 Oct 2026. Prices change. Confirm on the vendor site before you buy.
Pricing sourceUpdated
16 Oct 2026
Added
16 Oct 2026
Supported builders
It scans a public URL, so any of these builders qualify once the app is deployed. The site mentions Bolt and Cursor as typical ways people end up with a site they do not fully understand.
What it is
AmIHackable loads a public site the way a visitor’s browser would and reports what that view exposes: sensitive paths, keys in scripts, outdated libraries, TLS, cookies, and headers. The writing is aimed at someone who just shipped with an AI builder.
The pricing page said the scan and the full report are free while the product is rebuilt around a new detection engine. Some active checks are described as waiting on domain verification. A pass here does not see server-side logic the browser never receives.
Best for: A first look at what any visitor can already see on a deployed site, before you pay for a deeper test.
Watch-outs
- It does not read your source repository and it does not perform a full active penetration test.
- The free-while-rebuilding status can change. Re-check the pricing page.
Our take
Opinion from ShipSafeStack. Not a score, not a certification, and not a sponsorship.
A fast outside-in pass, and the author is unusually explicit about what the scan refuses to do. That honesty is the feature. Do not read a good grade as “the database rules are fine” if those rules are not visible from the outside.