Free security check for your Angular app
Enter your website and work email. We check what any visitor's browser can see: the framework version, known vulnerabilities, leaked keys, source maps and security headers.
- Angular, AngularJS, React, Next.js and Vue
- Report in a few minutes
- Fix instructions for each finding
Step 2 of 4
Check your inbox
We sent a confirmation link to . Open it to start the check of . The link is valid for 24 hours.
While you wait, we already found:
No email after a few minutes? Check the spam folder or .
Dev: open the confirmation link →What we check
Six groups of checks, focused on the problems we find most often in Angular audits.
Framework version and support
We read the Angular version from your page and compare it with the official support schedule and published security advisories. AngularJS has had no security fixes since January 2022.
Secrets in JavaScript bundles
API keys, access tokens and private keys that ended up in the code your server sends to every visitor.
Public source maps
A reachable .map file lets anyone download your original source code, including comments and internal API addresses.
Code that turns off XSS protection
Calls to bypassSecurityTrust* in Angular or dangerouslySetInnerHTML in React. We list where they appear so your team can review each one.
Security headers and TLS
Content Security Policy, Trusted Types, HSTS, cookie flags, certificate validity and TLS versions.
Outdated libraries and third-party scripts
jQuery, lodash, moment and other libraries with known CVEs, plus scripts from external CDNs loaded without an integrity check.
How it works
- 1Enter your website and work email
The email has to be on the same domain as the website, e.g. anna@acme.com for acme.com.
- 2Click the link we send you
This confirms you work at the company that owns the site. We don't scan websites for people from outside the company.
- 3We run the check
The scanner makes the same requests a browser makes when someone opens your site. No login attempts, no attack payloads. It takes a few minutes.
- 4You get the report
By email and as a private link valid for 30 days. Each finding says what we found, why it matters and how to fix it in your framework.
See a sample report
A report for a fictional shop running Angular 15, with 10 findings and fix steps for each.
Frequently asked questions
Is it really free?
Yes. You get the full report without a call or a contract. If you want help with the fixes, you can book a free consultation with our Angular team.
Can the scan slow down or break my site?
No. The scanner downloads the page and its scripts once, the same way a visitor's browser does. It doesn't submit forms, log in or send attack payloads.
Why do you need a work email?
A security report shows where a website is weak. We send it only to someone who can prove, by clicking a link in their inbox, that they work at the company that owns the domain.
Who can see my report?
Only people with the private link, which we send to the email you confirmed. We don't publish results or rankings. The report is deleted after 30 days.
What does the check not cover?
It sees what is publicly available: the page, its JavaScript and HTTP responses. It doesn't see your source repository, pages behind a login or your backend. For that, see our Angular code audit.
Does it work for React, Vue or Next.js?
Yes. Headers, TLS, secrets, source maps and libraries are checked for any site. Version and support checks cover Angular, AngularJS, React, Next.js and Vue.
Need a full security audit?
The automated check covers what is visible from outside. In a code audit our Angular experts go through your source code, dependencies and authentication flow, and hand you a prioritised list of fixes.
- No cost
- No NDA
- No sales reps
