Introducing AfterPack Site Security Scanner

Today we're launching AfterPack Site Security Scanner — a free tool that crawls your website with a real browser and tells you exactly what you're exposing to the world. Try it in the browser or run npx afterpack audit <url> from the terminal.

What Your Website Is Showing Everyone

Here's something most developers don't think about: every JavaScript file you ship is public. Every inline script, every third-party tag, every source map your build tool quietly generates. It's all there, waiting to be read.

And it's not just readable — it's searchable. Automated scanners trawl the web constantly, looking for API keys left in client bundles, source maps that serve your entire project tree, unprotected business logic that a competitor can study in an afternoon. AI models can now summarize and explain minified code in seconds, turning "security through obscurity" into no security at all.

We've seen AWS keys sitting in production bundles. JWT tokens hardcoded into authentication flows. Database connection strings embedded in client-side config files. Full source maps exposing original filenames, directory structures, and comments that were never meant to leave the build server.

You might not know this is happening on your site. We built a tool so you can find out.

What the Scanner Checks

The scanner analyzes your site across seven dimensions, each producing specific findings with severity ratings. Here's what each module looks for — with examples of real findings.

Secrets Detection

Scans every JavaScript file and source map for exposed credentials — AWS access keys, Stripe secrets, GitHub tokens, database URLs, JWTs, and 18 other pattern types. Findings are redacted automatically so sharing results is safe.

Protection Level

Classifies each script as obfuscated, minified, unprotected, or source-exposed. If your build is shipping readable code with original variable names, you'll see it here.

Code Readability

Measures how easily AI can understand your code, scored across keyword density, string exposure, identifier readability, structural clarity, and formatting signals. A high readability score means your logic is an open book.

Dangerous Patterns

Flags eval() usage, Function() constructors, document.write(), direct innerHTML assignment, and other patterns that expand your attack surface. Also detects publicly accessible source maps and exposed config files.

Tech Stack Detection

Identifies frameworks and libraries — React, Angular, Vue, Next.js, jQuery, and more — including version numbers where possible. Knowing what you're running is the first step; knowing that everyone else can see what you're running is the second.

Third-Party Analysis

Maps every external domain your site loads resources from — scripts, fonts, stylesheets, tracking pixels, API endpoints. Each one is a dependency you didn't write and can't control.

Bundle Composition

Detects bundled libraries and checks for known CVEs. If you're shipping a version of jQuery or lodash with a published vulnerability, the scanner will flag it.

How It Works

This isn't a static analyzer that fetches your HTML and calls it a day. The scanner uses Cloudflare Browser Rendering to load your site in a real browser, execute JavaScript, and capture every resource that gets loaded — including dynamically injected scripts and lazy-loaded bundles.

Results stream back in real time via SSE. You'll see findings appear as each module completes its analysis, with a running security score that updates progressively from 0 to 100. No waiting for a full report to generate — you're watching the scan happen live.

It's Free. No Signup.

Enter a URL. Get results. That's it.

No account, no email, no API key. The scanner is completely free to use. We built it because we believe every developer should be able to see what their site exposes — without friction.

Or Use the CLI

Prefer the terminal? The afterpack CLI includes the same scanner — one command, no browser needed. You'll need Node.js installed (npx ships with it):

Drop it into CI or run it before every deploy — catch exposed secrets before they ship.

Go Scan Your Site

Seriously — go try it in the browser, or run npx afterpack audit <your-url> in the terminal. Check the secrets tab. Look at your protection levels. See how many third-party domains are loading scripts on your pages.

If everything looks clean, great. You're ahead of most.

If you don't like what you see — that's exactly why we built AfterPack. The scanner shows you the problem. AfterPack is the fix: it defeats AI code analysis, blocks security scanners from mapping your attack surface, hides your tech stack and business logic, stops copycats from cloning your frontend, and prevents AI crawlers from harvesting your code as training data. All for as little as some slight JavaScript bundle overhead with afterpack --light.

---

The scanner is live now at afterpack.dev/security-scanner. Or run npx afterpack audit <url> from any terminal — it's on npm.

If you want to protect what the scanner finds, join the AfterPack waitlist — we're launching soon.

— Nikita