Scan like an attacker, safely
Exposed .env and .git files, secrets in JavaScript bundles, Supabase and Firebase rules, TLS, headers, email spoofing and more.
Scan. Watch. Restore.
Sleep easy.We stay awake.
Vigavo scans your site or app for exposed secrets, open databases and missing protections, watches it around the clock, and keeps verified backups you can restore in minutes.
Free. No signup. Read-only checks from the outside.
68explained checks in every scan
230secret key patterns searched in your JavaScript
0changes made to your site. Every check is read-only.
How it works
Three steps, no agent to install, nothing to change on your site.
Scan
Enter a URL. We run read-only checks from the outside and explain every result in plain language.
Watch
We re-scan on your schedule and alert you by email, Telegram, Slack or webhook when something changes.
Restore
Connect your database once. We back it up, prove each snapshot restores, and let you roll back in a few clicks.
Everything a small team forgets to check
Findings ranked by what an attacker would try first, with the fix right next to each one.
Watch for changes
Scheduled scans compare against the last result, so you hear about a new leak once, not every day.
Backups that restore
Encrypted database snapshots, verified by an actual restore and row counts.
Fix prompts
Each critical finding comes with a prompt you can paste into Cursor, Claude Code, Lovable or Bolt.
Alerts without noise
Deduplicated alerts, daily or weekly digests, and a clear grade from A to F.
Simple plans
Start with a free scan. Pay when you want monitoring and backups.
Scan
$29/year
Billed yearly only: a monthly charge this small would mostly go to card fees.
- 5 projects
- Light scans: Daily
- Full scans: Daily, up to 500 pages
- Backups: Weekly
- Backups kept 21 days · 2 GB storage
Complete
$9/month
$90/year
- 5 projects
- Light scans: Daily
- Full scans: Daily, up to 2000 pages
- Backups: Every 6 hours
- Backups kept 90 days · 30 GB storage
Agency
$29/month
$290/year
- 15 projects
- Light scans: Every 6 hours
- Full scans: Daily, up to 2000 pages
- Backups: every hour
- Backups kept 365 days · 100 GB storage
Questions
Is the scan safe for my site?
Yes. We only make the same read-only requests any visitor's browser could make. Nothing is changed and nothing is exploited.
Can I scan a site I do not own?
Only with the owner's permission. Site owners can opt out at any time; see the bot page.
What do you store?
The scan result. Free scans are deleted after 30 days.
Do you need access to my code or database?
Not for scanning: the scan only looks at what is public. For backups you create a read-only database user (we show the exact SQL), or connect Supabase in one click.
What happens if a scan finds a problem?
You get a plain-language explanation, why it matters, how to fix it, and for critical issues a ready prompt for your AI coding tool. Monitoring tells you when it is fixed.