Paste a URL, wallet, contract, email, or package.json — get a real security report in 10 seconds. Public-data scanners, zero account required.
Every app ships with at least one stale dep, one missing header, one forgotten .env. A free scan removes the excuse.
Signed modules are great. They are also useless if your host machine is leaking .env through /.git/config. Check both layers.
We are the same team that runs Sniper. Sniper watches bad actors. Shield helps good actors. Same data lake, opposite direction.
Shield never exploits, never attempts unauthorized access, never harvests credentials. Every check uses public data (DNS, Certificate Transparency, CVE databases, block explorer data, public breach databases). User-initiated only — you paste your own target.
We hash emails with SHA-256 before storing. For breach lookup we use HIBP's k-anonymity range API so your full hash never leaves this server. Scan reports are kept for 30 days then purged. No account, no tracking pixels.
If you opt in with an email, we will only notify you privately about new critical findings on your own target. We do not publish vulnerabilities about third parties.
Maybe, for continuous monitoring with SMTP alerts, longer retention, and SLA support. The core scan will always be free.
Yes. The probe sends a 1KB benign JSON body and a HEAD request to well-known endpoints (/.well-known/mcp, /version, /). No payloads, no fuzzing, no brute-force.