Free external scan
Hack me: see your app the way an attacker does
Hack me is a free, outside-in security scan of your web app. You prove you own the domain with a DNS record, and Supahound checks your security headers, TLS and the Supabase keys your frontend ships to every visitor. You get a score and a fix for every finding.
Last updated
Coming soonThe scan is in development. Create your account now and the scan shows up in it at launch.
How does the hack me scan work?
- 1
Enter your app's URL
Supahound works out the registrable domain (for example, app.example.com becomes example.com). The scan never leaves that domain.
- 2
Prove you own the domain
Add a TXT record we give you to your DNS. Supahound reads it through several public DNS resolvers, and they must agree. A meta tag or file upload is not enough, because it only proves control of the current web host.
- 3
Accept the scope agreement
You confirm that you own or are authorized to test the domain. Supahound keeps that agreement as an append-only record.
- 4
Get your report
You get a score, every finding with its evidence and a fix, and the full report by email.
What does the scan check?
- Security headers
- Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Referrer-Policy and Permissions-Policy, checked on your pages.
- TLS
- Certificate validity and expiry, protocol versions and HTTPS redirects.
- Supabase exposure
- Supahound reads your public JavaScript and network calls to find your Supabase project URL and the keys your frontend ships. It flags a service_role or secret key in the browser at once.
- Next steps
- Each finding maps to the Supahound monitor that would catch someone using it. Connect your Supabase org to turn the snapshot into always-on detection.
Why is a scan not enough?
A scan is a photo of one moment. It cannot tell you that a user started reading other users' rows an hour after you shipped a new policy, or that your service key just called your API from a network it has never used. Supahound's runtime detection watches your Supabase logs every 1–2 minutes for exactly that.
Frequently asked questions
- Is the hack me scan free?
- Yes. The external scan is free. It is the one-time snapshot; Supahound's paid plans are the always-on version.
- Can I scan a site I do not own?
- No. The scan runs only after you prove control of the domain with a DNS TXT record, and only against that domain. Government, military and major platform domains are blocked even with a TXT record.
- Will the scan break my app?
- No. Today the scan runs passive checks only: it reads the same headers, certificates and public JavaScript that any visitor's browser receives. It does not try exploits or send attack payloads.
- Why DNS and not a file upload?
- A DNS TXT record proves control of the domain itself, not only of today's web host, and it keeps working if you move hosts. That makes it the stronger authorization record.
- What happens to my report?
- Your report lives in your Supahound account, under the same tenant isolation as the rest of your data.
Scan your app, then keep watching it
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.