securealy

# Securealy

You just shipped something with Lovable, Bolt, v0, Cursor or Claude Code. It works. Is it safe to put in front of strangers?

Securealy grades a URL the way an attacker and a customer would see it, in under a minute, and shows the fix for everything it finds.

```
npx securealy grade https://your-app.vercel.app
```

```
 ####     securealy  https://your-app.vercel.app
 #   #    Grade D  (64/100)   passive tier   19 requests   4.1 s
 #   #    1 blocker . 6 fail . 4 warn . 31 pass . 9 skip . 0 error
 #   #    capped: D or lower because of 1 blocker
 ####     stack: host vercel . builder lovable . db supabase . payments stripe

BLOCKERS
  FAIL  secrets-in-bundle    sk_live_... (stripe-secret) found in /assets/index-8f3a.js (redacted)
                             No secret keys in client JavaScript (blocker) -> https://securealy.com/checks/secrets-in-bundle
```

This repository is the open-source engine: the check catalogue, the grading library, the CLI, the MCP server, the Claude Code plugin, the GitHub Action and the test fixtures. The hosted grader at [securealy.com](https://securealy.com) runs the same code.

## What it checks

58 remote checks and 7 local ones, every one of them listed in [`packages/checks/checks.json`](packages/checks/checks.json) with what passing means and why it matters.

| Category | Examples |
|---|---|
| Security | TLS, HSTS, CSP strength, cookie flags, CORS, source maps, secret keys in bundles, Supabase REST exposure, Firebase config |
| Payments | Stripe test key in production, webhook wiring |
| Email | SPF, DKIM, DMARC, MX, whether your magic-link sender is authenticated |
| Domain | Nameservers, DNSSEC, CAA, registration expiry, security.txt |
| Hygiene | Soft 404s, builder badges and chat residue, broken links, legal pages, env example parity |
| SEO | Title, description, canonical, H1, Open Graph image, JSON-LD, robots, sitemap, llms.txt, AI crawler policy |
| Analytics | Analytics installed, consent mechanism where required |
| Performance | TTFB, page weight, largest image, render-blocking resources |

## The three tiers

**Passive** works on any URL and does only what a browser does when a visitor opens the site, plus DNS and TLS lookups: the home page and its first-party scripts, robots.txt, sitemap.xml, security.txt, one random path for the 404 check, a HEAD on the social image. At most 25 requests, 8 seconds each, 3 redirects, 45 seconds in total. Never port scans, never guesses credentials, never reads rows.

**Verified** runs after you prove you own the domain. It adds the probes you would want run against your own site but nobody should run against someone else's: `/.env` and `/.git` served by URL, internal files, admin and API routes answering anonymous requests, Supabase tables returning rows to the anon key, listable storage buckets, and a 10-request burst to see whether anything rate-limits.

**Local** runs on your machine with your own credentials and nothing leaves it except the result you choose to post:

```
npx securealy scan-repo            # secrets in git history, .gitignore coverage, .env.example parity
npx securealy check-rls            # SUPABASE_MGMT_TOKEN + project ref, or SUPABASE_URL + SUPABASE_SERVICE_KEY
npx securealy check-stripe         # STRIPE_SECRET_KEY (+ SECUREALY_PRODUCTION_URL to compare the webhook host)
npx securealy check-vercel-env     # VERCEL_TOKEN + VERCEL_PROJECT_ID (+ SECUREALY_VERCEL_DECRYPT=1 to read values)
npx securealy local                # all of the above
```

## Not deployed yet?

An app that only runs on your machine still gets a grade:

```
npx securealy local                          # repo checks that need no URL at all
npx securealy grade http://localhost:3000    # pre-launch grade of the running app
```

The second one is a **pre-launch grade**: the result carries `preLaunch: true`, the checks that need a public domain (TLS, HSTS, the https redirect, DNS, email, domain registration, the Stripe live key, server latency) are skipped with the reason, and the score covers the rest, so a clean local app can reach A. Blockers such as a secret in the bundle, a missing CSP and leaky cookies apply exactly as they will after launch. `localhost`, `127.0.0.1`, `[::1]`, `*.localhost` and `*.test` qualify, plain `http://` included; every other private address is refused as always.

Then get to a real domain with Module 00 and Module 01 of the Fix Kit (or its `AUTOPILOT.md`), and run the same `grade` command on that URL for the real grade.

Every environment variable is trimmed before use, sent only to the service it belongs to, and never printed. Evidence is redacted at the source: a found key shows as its first six characters and an ellipsis. The service key goes only to an https URL on a Supabase-hosted domain (`SECUREALY_SUPABASE_HOST_OVERRIDE=1` for a self-hosted project), and the Vercel check reads variable values only with `SECUREALY_VERCEL_DECRYPT=1`; without it the trailing-newline and live-key checks are reported as skipped. The full list of variables read and hosts contacted is under "What leaves your machine".

## The learning record

Every `grade`, `local`, `scan-repo`, `check-rls`, `check-stripe` and `check-vercel-env` run (and every `grade_url`, `scan_repo`, `check_rls`, `check_stripe` and `check_vercel_env` call through the MCP server) appends one entry to `.securealy/history.json` in the current working directory:

```json
{ "at": "2026-10-12T23:00:00Z", "command": "grade", "tier": "passive", "host": "your-app.com",
  "grade": "B", "score": 83, "summary": { "blocker": 0, "fail": 4, "warn": 3, "pass": 38, "skip": 6, "error": 0 },
  "id": "g_01J...", "failed": ["hsts", "not-found-page"], "engineVersion": "0.1.4" }
```

That is the whole entry: ids and numbers. Never evidence strings, never tokens, never environment values; `host` is recorded only for a grade of a URL. The newest 200 entries are kept, and a `README.md` beside the file explains it. The file is safe to commit. The next `grade` of the same host prints one line against the previous entry:

```
Previous grade B 83 on 2026-10-12; 2 checks improved, 1 regressed: not-found-page
```

The `grade_url` summary from the MCP server carries the same line, and the launch-check skill reads the file before grading again so it can report the trend. Turn it off with `--no-history` or `SECUREALY_NO_HISTORY=1`. If the working directory is not writable, nothing is written and nothing is said.

## Verifying ownership

```
npx securealy verify your-app.com --token sly_...
```

prints three options; use any one:

1. a DNS TXT record at `_securealy.your-app.com`
2. a `<meta name="securealy-verify">` tag in the home page
3. a file at `/.well-known/securealy.txt`

The published value is a fingerprint of your token, never the token. Then:

```
npx securealy grade https://your-app.com --tier verified --token sly_...
```

Vercel deployment protection? Pass `--bypass <protection bypass token>` and it is sent as the `x-vercel-protection-bypass` header on requests to your host only. In CI, set `SECUREALY_TOKEN` and `SECUREALY_BYPASS` in the environment instead of the flags, so neither token appears on a command line.

## Opting out

Add a TXT record `_securealy` with the value `optout`, or send an `X-Securealy: optout` response header. The grader checks both before anything else and stops.

Every request identifies itself as `SecurealyGrader/1.0 (+https://securealy.com/grader)`.

## Using it from an agent

The same checks are available to coding agents through the `securealy-mcp` server: `grade_url`, `scan_repo`, `check_rls`, `check_stripe`, `check_vercel_env`, `get_check`, `list_checks`, `fetch_fix` and `post_result`, plus the catalogue and this spec as resources. Every output is passed through a redactor.

**Claude Code plugin** (adds the `/securealy:launch-check` skill and the server):

```
claude plugin marketplace add securealy/securealy
claude plugin install securealy@securealy
```

The marketplace is published from this repository.

**Claude Code, server only:**

```
claude mcp add securealy -- npx -y securealy-mcp
```

**Cursor:** [Add to Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=securealy&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsInNlY3VyZWFseS1tY3AiXX0=), or add to `mcp.json`:

```json
{ "mcpServers": { "securealy": { "command": "npx", "args": ["-y", "securealy-mcp"] } } }
```

**VS Code:** [Install in VS Code](vscode:mcp/install?%7B%22name%22%3A%22securealy%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22securealy-mcp%22%5D%7D), or `code --add-mcp '{"name":"securealy","command":"npx","args":["-y","securealy-mcp"]}'`.

**Codex:**

```
codex mcp add securealy -- npx -y securealy-mcp
```

**Any other MCP client:** run `npx -y securealy-mcp` over stdio. The server is listed in the MCP Registry as `com.securealy/mcp`.

**Agent skills:** the `launch-check` skill in `skills/` follows the Agent Skills format, so `npx skills add securealy/securealy` installs it into any compatible agent.

### What leaves your machine

The passive grade sends requests only to the URL being graded (what a browser would request, at most 25) plus DNS, TLS and RDAP lookups for its domain; nothing goes to Securealy. The verified grade sends the URL and your project token to securealy.com. `fetch_fix` sends a check id to securealy.com. `post_result` sends a result and your token to securealy.com, and only when you ask. The repository scan reads the folder you confirm and sends nothing. The Supabase, Stripe and Vercel checks read their credentials from your environment, send each one only to the service it belongs to, and never print them. The learning record (`.securealy/history.json`) stays on your machine.

**Hosts contacted.** `grade`: the URL you give, the hosts it redirects to, and the same-site URLs found in the page (scripts, source maps, sitemap entries, links, images, `og:image`, the icon); the Supabase project URL found in a bundle and `firebases