Free tools, no account

Each one looks at a single thing, in a few seconds. For everything else, there's the scan.

• Security headers test

  What your site sends to browsers, and the missing line.

  What it does

  A single visit to your home page, like a browser: HSTS, CSP, cookies, certificate. For every missing protection, the line to add for Vercel, Netlify, nginx or Apache.

  What it doesn't see

  Only the home page and its headers. Not your exposed files, your versions or your database.

  Open the tool

• Supabase checker

  The tables anyone can read, tested from your browser.

  What it does

  From your browser, with the anon key your app already publishes: the tables anyone can read, and how many rows. Nothing is downloaded, nothing is sent to Rustine.

  What it doesn't see

  Not writes, file storage or RPC functions. An empty table with an open rule looks protected.

  Open the tool