Scan a web app (free, passive)
scan_urlRead-onlyIdempotent
Run ShipLatch's free passive security scan on a public web app URL (for example a Lovable, Bolt, Replit or Cursor app). Read-only: it fetches the page and its public JS like a browser would and never logs in, submits forms or tests exploits. Returns the grade, issue counts and the type of each issue; exact locations and fix prompts stay in the full report for the verified owner. Only scan sites you own or are authorized to test. Results for the same site are cached for 24 hours. If the scan takes longer than about 25 seconds it returns status "running" and a scan_ref: call get_scan with it.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The app's public URL, e.g. https://myapp.lovable.app | |
| focus | No | Optional: also answer one question yes/no. env = is a .env file public; vite = is a dev server exposed; rls = Supabase key exposure; gemini = Gemini/Google AI key exposure. |