# DeploySafe

> DeploySafe is a web application security scanner for developers and indie makers. You paste a live URL and DeploySafe runs automated attack simulations against your deployed app, returning a prioritized list of vulnerabilities with actionable fix guidance.

DeploySafe probes a live, running application the way an attacker would. It is not a static code scanner. Each scan first maps the app's attack surface through route discovery, then runs more than 20 independent security probes, then triages the findings into a report grouped by severity. Scans typically take 5 to 15 minutes.

## How a scan works

- Paste a live app URL, for example https://your-app.vercel.app
- DeploySafe discovers routes, then runs security probes against them
- Results stream to a live terminal-style view as the scan runs
- Findings are triaged and grouped by severity: Critical, High, Medium, Low, Info
- Each finding includes a description and a fix recommendation
- Before scanning, users must confirm they own the target or have authorization to test it

## What DeploySafe tests

DeploySafe runs probes for issues including: authentication bypass, insecure direct object references (IDOR), CORS and CSRF misconfigurations, missing security headers, insecure cookie flags, excessive data exposure, exposed environment and config files, error and stack trace disclosure, HTTP method tampering, SQL and NoSQL injection, command injection, path traversal, open redirects, missing rate limiting, prototype pollution, insecure localStorage use, unvalidated file uploads, vulnerable dependencies, the Next.js middleware bypass (CVE-2025-29927), unsigned webhooks, and robots/sitemap leaks.

## Authenticated scans

Users can optionally provide a test account email and password. DeploySafe logs in as that user to find vulnerabilities that only appear behind authentication, such as broken access control and IDOR. A throwaway test account is recommended. For one-time scans, credentials are encrypted, used only for that scan, and deleted as soon as it finishes. For Continuous Monitoring, they are stored encrypted so each scheduled scan can re-authenticate.

## Pricing

DeploySafe is sold as a monthly or annual subscription. Every plan bundles monthly scan credits with continuous monitoring, the automatic re-scanning of your live apps. Annual plans are billed yearly and include two months free.

- New accounts get 10 free credits, enough for one scan, no card required
- Each on-demand scan costs 10 credits. Monitoring scans run automatically and never use credits
- Every scan returns a prioritized report of the vulnerabilities found, grouped
  by severity, with remediation steps
- Paid plans can download any scan's findings as a shareable, branded PDF report, or copy them as markdown to paste into an AI or a doc
- Solo is $12 per month: 1 monitored app and 200 credits per month (20 scans)
- Pro is $29 per month: 3 monitored apps and 500 credits per month (50 scans)
- Agency is $79 per month: 10 monitored apps and 1,200 credits per month (120 scans)
- Monthly plan credits roll over up to twice the monthly amount. Purchased credits never expire
- Subscribers can top up any time with one-off credit packs: 100 credits for $9, or 250 credits for $19
- Payments are processed by Polar. Cancel anytime; access continues until the end of the paid period. Purchases are non-refundable.

## Continuous Monitoring

Continuous monitoring is included with every subscription. DeploySafe automatically re-scans your live apps and emails you the full findings, so you do not have to remember to scan or log in to see results.

- Connect a GitHub repository and DeploySafe scans on every push to your chosen branch. If you do not connect GitHub, it scans on a regular weekly schedule instead
- Monitoring scans are free and never use your credits
- The number of apps you can monitor depends on your plan: 1 on Solo, 3 on Pro, 10 on Agency
- The complete findings and copy-paste fixes are emailed after each run
- Optional authenticated scanning: credentials are stored encrypted and reused for each scheduled scan

## Free tools

DeploySafe provides free, single-check tools that require no account.

- [Exposed API Key Checker](https://deploysafe.io/tools/exposed-api-keys) — scans a site's JavaScript bundles and common .env paths for leaked secrets (Stripe keys, OpenAI keys, AWS keys, Supabase service-role keys, and more). Found secrets are shown masked. Stores nothing.
- [Security Headers Checker](https://deploysafe.io/tools/security-headers) — fetches a URL and grades its HTTP security headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) on an A–F scale.
- [All free tools](https://deploysafe.io/tools)

## Blog

Practical web security writing for indie makers and developers shipping apps built with AI tools.

- [The vibe coder's security checklist](https://deploysafe.io/blog/vibe-coded-security-checklist): a plain-English checklist of the security issues AI coding tools (Cursor, Lovable, Replit) commonly leave out, with how to check each one.
- [All posts](https://deploysafe.io/blog)

## Links

- [Free security tools](https://deploysafe.io/tools)
- [Blog](https://deploysafe.io/blog)
- [Terms of Service](https://deploysafe.io/terms)
- [Privacy Policy](https://deploysafe.io/privacy)
- [Status](https://status.deploysafe.io)

## Contact

- legal@deploysafe.io