ScanYourSite

Your Replit app is deployed. Is it locked?

Replit Agent can build and deploy an app in one session. The deployment is real — and so is everything it serves. Paste the URL and see what a visitor can reach that they shouldn’t.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.

See a full example report

What we check on a Replit deployment

Hand the fix back to Replit Agent

Every report includes a prompt with the findings, their location and how to verify the fix. Paste it into the Agent.

Fix these issues on my-app.replit.app.

1. A SendGrid API key is in static/app.js.
   Revoke it, store the new one in Replit Secrets and send mail from the server route only.

2. No Strict-Transport-Security header.
   Add it in the server's response middleware.

When done, re-check: https://scanyoursite.app/en?check=my-app.replit.app

Know before your users do

With Pro: uptime every five minutes, a check after every deploy and alerts only when something changes — in Telegram, by email or to Slack and Discord.

See plans

Questions

Does it need access to my Repl?

No. We check the deployed site from the outside.

How fast will I know the app is down?

On Pro the site is checked every five minutes, and an outage is confirmed by a second check before we alert you.

What about my server itself?

If you run your own VPS, our open-source server agent reports disk, open ports, firewall and backups. Replit deployments don’t need it.

For vibe coders

Paste your URL. Get the list in about a minute.

Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.