secretsscan ▸
Exposed secrets
API keys, tokens and credentials hardcoded into the JavaScript bundles your visitors download.
$ AIzaSyD7q…b2 — found in /static/chunks/main.js
Free exposure scan
You shipped fast. Let's make sure you didn't ship your secrets too.
Raksha Kavach checks your live site for exposed API keys, missing security controls and leaked URLs — the things that slip through when you move fast. No installation, no code access.
Free scan, 60 seconds. See exactly what's exposed — and how to close it.
- Free, no signup
- ~60 second scan
- No code access
live demotry any domain
raksha-scan — passive reconready
raksha@scan:~$ ./scan --mode passive
Enter your domain. We read only what's already public — no login, no code, no card.
~60s · 5+ exposure classes · no data stored
- Free teaser scan in ~60 seconds
- GST invoice included
- Money-back if your app is clean
- No scan data sold or shared
- Aligned with CERT-In recommended practices
- Findings mapped to DPDP safeguards
- Built and run in India
- WhatsApp support
What we scan for
The exposures AI tools quietly ship to production
Every scan looks for the same classes of issue we keep finding in SMB sites and AI-built apps — the gaps attackers and automated bots probe for first.
headersscan ▸
Security headers
Missing CSP, HSTS and X-Frame-Options that leave you open to clickjacking and script injection.
$ content-security-policy: (absent)
sourcemapsscan ▸
Source maps
Your original, un-minified source code served publicly through leftover .map files.
$ GET /static/index.js.map → 200 OK
subdomainsscan ▸
Forgotten subdomains
Staging and dev environments — often unprotected — indexed in public certificate transparency logs.
$ staging.yourapp.com — crt.sh match
dnsscan ▸
DNS & email spoofing
Misconfigured SPF/DMARC and dangling records that let attackers send mail as your domain.
$ DMARC policy: none
compliancescan ▸
DPDPA & CERT-In gaps
Your exposures mapped against CERT-In recommended practices and DPDPA expectations.
$ 12 controls assessed
How it works
From URL to fixed in three steps
No agents to install, no source code to hand over. You stay in control the whole way.
- 01step 01
Enter your URL
The free teaser scan runs on public signals only — what anyone on the internet can already see. No code, no login, no card.
- 02step 02
Verify & go deep
Prove you own the domain, then unlock the full scan across 40+ vectors with severity-ranked findings and a GST invoice.
- 03step 03
Fix & stay safe
Follow plain-English remediation steps, or let our team patch it for you. Raksha Kavach keeps watch on your domain all year.
Why trust us
Built to earn trust, not spread fear
Security shouldn't feel like a threat. We show you exactly what we found, explain why it matters, and only charge when there's something worth fixing.
Your data stays yours
We scan public signals and verified pages. We never sell or share what we find — your report is for you alone.
Money-back if you're clean
If a paid deep scan turns up no actionable issues, we refund it. We only charge when we've found something worth fixing.
Real humans on WhatsApp
Stuck on a fix or unsure what a finding means? Message our team directly — no ticket queue, no bots.
Compliance-aware by design
Findings are mapped to CERT-In recommended practices and DPDPA expectations, so you know what regulators care about.
Pricing
Honest pricing. No lock-in.
Start with a free scan — no signup, no card. When you want year-round cover, Raksha Kavach watches your domain so you know first.
Free Scan
Verify your domain, see every hole we can see.
Freeno card
- Passive scan of public signals in ~60 seconds
- Verify ownership to unlock the full deep scan
- Severity-ranked findings in plain English
- No signup, no code access
Raksha Kavach
Year-round cover for your domain — we watch, you know first.
₹3,750/mo · billed annually — ₹44,999/yr*
- 25% off the ₹4,999/mo rate
- Deep scan included — runs the day you start
- Continuous monitoring on your domain, all year
- Alerts the moment new exposures appear
- Fix guidance on every finding
- DPDP-readiness reporting, mapped to CERT-In practices
Kavach
We fix it for you — 10 PRs in 2 weeks.
₹14,999one-time
- Up to 10 pull requests
- Delivered within 2 weeks
- Each fix reviewed & tested
- Includes re-scan to verify
- Need more? Compliance Sprint quotes start here
*Ex-GST. 18% GST added at checkout — GST invoice included. One-off purchases include GST.
FAQ
Questions, answered
Is the free scan really free?+
Yes. The teaser scan checks public signals only — things anyone on the internet can already see — and needs no signup or card. You only pay if you want the full report.
Will scanning break or slow down my website?+
No. A teaser scan is passive: we read what your site already exposes publicly. The full scan is rate-limited and runs only after you verify domain ownership.
Do I need to be technical to use this?+
No. Every finding comes with a plain-English explanation and fix. If you'd rather not touch code at all, our Kavach engagement handles it for you — 10 PRs in 2 weeks.
Do you provide a GST invoice?+
Yes — every paid scan and service includes a proper GST invoice you can download for your records.
What's the difference between the Free Scan and Raksha Kavach?+
The Free Scan is a one-time look: verify your domain and see everything the scan can find today. Raksha Kavach covers you all year — continuous monitoring, alerts when new exposures appear, and fix guidance on every finding. Want it fixed for you? Kavach (₹14,999) and scoped Compliance Sprint quotes handle remediation.
See what's exposed — in 60 seconds
Run a free teaser scan on any domain. No signup, no card — just the public signals attackers already see.
Scan my site free