Secure Vibes

How to recognise it

Every request our scanner sends carries this User-Agent:

Mozilla/5.0 (compatible; SecureVibesScanner/1.0; +https://secure-vibes.com/scanner)

All scans come from our own server, never from your visitors' browsers. If you need our scanner's IP address to recognise or block it, get in touch.

What it does

  • Free outside check: it looks only at what any visitor can see: your homepage and the files it loads, your HTTPS setup, your public DNS and email records, and a short list of well-known file names (for example /.env), with one normal request each. It reads response codes and file signatures, and discards the contents.
  • Owner check (free): only after the person who asked has proven they own the site, checked again each time. On top of the outside check, it asks for a longer list of commonly exposed files (backups, configuration files, debug pages) and sends a few requests with a foreign Origin header to test cross-site (CORS) rules. Read-only GET requests only.
  • Deep check: only after the person who asked has proven they own the site (a tag on the homepage, a file, or a DNS record, checked again before every deep check) and agreed to active testing. It then checks whether strangers can read the site's database, file storage, API and AI features, using only the public keys the site itself publishes.
  • It keeps the request rate low and stops at the first sign of trouble.

What it never does

  • It never logs in, guesses passwords, or uses any secret key it finds.
  • It never changes or deletes anything: no POST, PUT, PATCH or DELETE requests to your site.
  • It never floods your site or tries to take it down.
  • It never scans government or military websites, hospitals, schools and universities, or sites on our excluded list, whoever asks.
  • Until someone proves they own a site, their report shows what is wrong but not where, so it can't be used as a map to attack you.

Don't want your site checked?

Exclude your website. It's free: sign in, prove the site is yours, and nobody else can check it with Secure Vibes. You can include every subdomain.

Report abuse

Think someone used Secure Vibes against your site without permission? Get in touch with your site's address and the time you saw the requests. Every scan is logged with the account, IP address and time of the person who asked for it, and we act on reports quickly: we can block the account and the site the same day, and we cooperate with the authorities.

Security issue in Secure Vibes itself? See our security contact.