You shipped your app over a weekend with an AI and it works. Great. Now the uncomfortable question: is it secure? The good news is that the basic checks do not require an expert or touching the code. In five minutes you can rule out the most common flaws. Here is the route.
1. Confirm HTTPS works
Open your site and look at the padlock. Then try visiting with http:// (no s): it should redirect you to https:// on its own. If it lets you stay on HTTP, you have an open door. Also check that the certificate is not about to expire.
2. Look at the security headers
These are invisible settings that tell the browser how to protect you. The ones that matter most: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options and X-Content-Type-Options. Almost no template ships with them. Their absence is not an instant breach, but it is low-hanging fruit for an attacker.
3. Hunt for secrets in your JavaScript
This is the star mistake of vibe coding: leaving an API key, a token or a credential inside the code sent to the browser. Everything that reaches the browser is public. Open the developer tools, look at the JS files and search for anything that looks like a key. If you find one, rotate it now and move it to the server.
4. Review CORS and cookies
If your app has a login, check that session cookies use HttpOnly and Secure, and that your API does not accept requests from any origin with credentials. This is the kind of silent flaw that throws no error but exposes data.
5. Check for files that should not be public
Try opening paths like /.env, /.git/config or forgotten backups. If the browser shows them, anyone can download them. They should return an error or not exist on the server.
With the list in hand, do not panic: prioritize. First the exposed secrets and accessible files (immediate impact), then HTTPS and cookies, and finally the headers. Each fix is usually one config line or a small change.
Do it all at once with Scanaris
The five steps above, plus around 45 checks, is exactly what Scanaris does in about 30 seconds: read-only over public information, no pentesting and no exploiting anything. For every finding it hands you a fix prompt ready to paste into your AI and solve it without knowing security. Scan your site and clear the doubt today.