About
ChillScan is the chill pre-launch check for your website or app. Works on any site, and it's especially handy for vibe-coded apps built with Lovable, Bolt, v0, Cursor and Replit, where secrets and missing basics slip through easily.
Paste a URL and in ~30 seconds ChillScan checks: leaked API keys and secrets in client-side code (OpenAI, Stripe, Supabase service_role, etc.), security headers (CSP, HSTS, X-Frame-Options and friends), HTTPS and redirect setup, SEO basics (titles, meta descriptions, sitemap, robots, social previews), and performance red flags.
Results are in plain English, no security degree required.
Pricing: Free scan ($0, unlimited, top 3 findings, no signup). Deep scan ($12 one-time, every finding with evidence, plus a copy-paste AI fix prompt so Cursor or Claude can fix it all in one go). No subscription.
ChillScan only reads what any visitor's browser can already see: no logins, no intrusive testing. Built by Ryan Young, an indie maker who likes shipping fast and sleeping well.