01Web check

Check your app from the outside

yof looks at your live app the way a stranger would. It reads only what any visitor's browser can see, and tells you what is exposed.

Start free How yof checks

How it works, step by step

yof.io · check my live appSample data

Paste the addressNo account needed. Nothing is stored.yof reads what a visitor seesThe start page, its scripts, the headers and public DNS. It never signs in.Each check gets a resultKeys in the page code, open databases, open files, admin pages, headers and email.A score with its coverageThe score always says how much of the app yof could see.Prove the app is yoursA tag, a file or a DNS record. Then yof runs the full check and shows every finding with its fix.

https://shop.exampleCheck my app

read the start page ✓ · 14 scripts ✓ · headers ✓ · public DNS ✓

Keys and secrets in your page code1 serious

A database anyone can readneeds your proof

Files left opennothing found

Security headers and HTTPS2 found

Protection against fake emailsnothing found

Health score 61 · coverage 16% (outside only)not a full security review

index.htmla tag, a file or a DNS record

+ <meta name="yof-verify" content="yof_3lPP…" />

owner verified ✓ · full check: 20 findings, each with its fix

https://shop.exampleCheck my app

read the start page ✓ · 14 scripts ✓ · headers ✓ · public DNS ✓

Keys and secrets in your page code1 serious

A database anyone can readneeds your proof

Files left opennothing found

Security headers and HTTPS2 found

Protection against fake emailsnothing found

Health score 61 · coverage 16% (outside only)not a full security review

index.htmla tag, a file or a DNS record

+ <meta name="yof-verify" content="yof_3lPP…" />

owner verified ✓ · full check: 20 findings, each with its fix

https://shop.exampleCheck my app

read the start page ✓ · 14 scripts ✓ · headers ✓ · public DNS ✓

Keys and secrets in your page code1 serious

A database anyone can readneeds your proof

Files left opennothing found

Security headers and HTTPS2 found

Protection against fake emailsnothing found

Health score 61 · coverage 16% (outside only)not a full security review

index.htmla tag, a file or a DNS record

+ <meta name="yof-verify" content="yof_3lPP…" />

owner verified ✓ · full check: 20 findings, each with its fix

https://shop.exampleCheck my app

read the start page ✓ · 14 scripts ✓ · headers ✓ · public DNS ✓

Keys and secrets in your page code1 serious

A database anyone can readneeds your proof

Files left opennothing found

Security headers and HTTPS2 found

Protection against fake emailsnothing found

Health score 61 · coverage 16% (outside only)not a full security review

index.htmla tag, a file or a DNS record

+ <meta name="yof-verify" content="yof_3lPP…" />

owner verified ✓ · full check: 20 findings, each with its fix

https://shop.exampleCheck my app

read the start page ✓ · 14 scripts ✓ · headers ✓ · public DNS ✓

Keys and secrets in your page code1 serious

A database anyone can readneeds your proof

Files left opennothing found

Security headers and HTTPS2 found

Protection against fake emailsnothing found

Health score 61 · coverage 16% (outside only)not a full security review

index.htmla tag, a file or a DNS record

+ <meta name="yof-verify" content="yof_3lPP…" />

owner verified ✓ · full check: 20 findings, each with its fix

AI writes fast. Mistakes ship faster.

An assistant can build a whole app in an afternoon. It can also leave a door open without telling you. yof follows every change and brings it back to one clear answer: safe to share, or what to fix first.

How it works

From your app's address to a fix, in three steps

Paste your app's address
yof reads what any visitor's browser can see and lists what is exposed. No account needed.
Show the app is yours
Then yof runs the full check and explains each finding in plain words.
Fix it, and yof checks again
Paste the fix prompt into your AI, or let Patch open a draft pull request.

01 Catch · Finds what is exposed

Find the open doors before someone else does

yof looks at your app the way a stranger would, and lists what is exposed: keys, customer data, pages without a lock.

How yof works, shown with sample data

UrgencyApp: shop.example

Open findings20

Fix now8

Fix this week9

Nice to have3

Needs validation4

Passed142

UrgencyFindingFound

Fix nowThe customers table can be read by anyoneYF-5E2F0003_customers.sql1 dPatch

Fix nowYour Stripe webhook secret is in your page codeYF-F000/assets/index-4f2a91.js3 d

Fix this weekYour hosting config sets no security headersYF-C07Bvercel.json2 dPatch

Fix this weekA workflow uses outside actions without a fixed versionYF-3D9Edeploy.yml4 dPatch

Fix this weekNeeds validationYour domain doesn't say who may send its emailYF-A81Cshop.example9 d

Nice to haveNo rule limits which scripts can runYF-B2D4shop.example21 d

Leaked keysKeys and passwords anyone can copy from your code.
Open databasesCustomer data anyone on the internet can read.
Pages without a lockAdmin pages and routes that open without signing in.
Made-up packagesAdd-ons your AI invented, or a lookalike of a real one.
Known security holesParts of your app with a published weakness.

Start free

04 Watch · Keeps checking

Still watching after launch

Once your app is live, yof checks it every day and sends one short email: nothing new, or the one thing to fix first.

How yof works, shown with sample data

OverviewFindings 20Checks 8ActivityReportsshop.example · checked today 02:26

Health

Mostly healthy

72/ 100

Coverage64% of what yof can check

Open findings20

Passed checks142 of 164

Next daily checkTomorrow, 02:26

Fix first

See all 20

Fix now

The customers table can be read by anyone

Database · supabase/migrations/0003_customers.sqlFix

Fix now

example-http-kit 0.52.1 has a vulnerability already used in attacks

Packages · requirements.txt · fixed in 0.52.3Fix

Fix this week

A value that looks like a password is written in your code

Code · .github/workflows/deploy.yml:41Fix

17 more683

yof is working

Patch is writing a fix for the customers row rulesnow

Re-tested fix #18: the open table is closed09:14

Checked 42 routes as 3 roles, 1 rule broken02:31

Daily check finished: 2 new, 3 fixed02:26

Read the repository: 214 files, 38 routes02:24

The next daily check is set for tomorrow02:26

Ask yof about this app

Security trend

Fix nowFix this weekNice to havePassed

14.1021.1028.1004.1111.11

Coverage

What yof could not check

64%

Outside checksChecked

Code and packagesChecked

Pages behind a loginPartly

Every page, not only the first onesPartly

Attack testsNot set up

AI assistantNot set up

Checked today02:26

Set up the two missing parts to raise coverage from 64% to about 90%.

Check history

30 days · by check area

Keys and secrets30/30

Database12/14

APIs28/30

Headers and HTTPS9/10

Code41/44

Packages18/22

AI assistant–

Attack tests–

PassedFix this weekFix nowNot checked

Findings by urgency

20 open

Fix now

Fix this week

Nice to have

Needs validation

Needs validation: yof saw a sign of a problem but could not prove it. Not counted in the score.

Daily checkYour live app, checked once a day.
New security holesTold the day one appears in a package you use.
One short emailAll good, or the one thing to fix first.
Fix as a draftA ready change that waits for your yes.
Agent logEvery step yof took, written down.

See the dashboard preview

Check your app from the outside

How it works, step by step

AI writes fast. Mistakes ship faster.

From your app's address to a fix, in three steps

Paste your app's address

Show the app is yours

Fix it, and yof checks again

Find the open doors before someone else does

Still watching after launch