How the site check works

When someone asks Holefind to check a live website, we open that one page the way an ordinary visitor's browser does, and nothing more.

What we load

• The page address we were given, following up to 5 redirects.
• The scripts and stylesheets that page itself loads from the same site.
• The plain http:// version of the address, to see whether it redirects to HTTPS.

Our requests identify themselves as HolefindSiteCheck/1.0. Every request is a normal GET. A check makes at most around 30 requests and takes a few seconds.

What we never do

• Guess hidden paths such as /.env, /.git or /admin.
• Follow links to other pages, read sitemaps, or crawl the site.
• Submit forms, log in, send data, or change anything.
• Download source maps.
• Use any key we find, or contact any service it belongs to, unless you opt in to the database test below.

What we look for

Secret keys shipped in the site's code, missing security headers, cookie settings, CORS settings, HTTPS and certificate problems, and hints such as version banners or development builds. The person who asked sees the results with plain-English fixes.

The optional database test

If your site uses Supabase, you can tick a box to confirm the app is yours and ask us to test whether its database can be read with the public key your site already gives every visitor. This is off unless you tick that box. When you turn it on we use only that public key, against only the Supabase project your site itself uses, and we send only count-only, read-only requests. We find out which tables and storage buckets can be read, but we never read, change or store the contents of any row, and we never try any other key. If a table can be read by anyone, that means Row Level Security is off, and we show you how to turn it on.

What we keep

The address that was checked, the findings and a short summary. We never keep the site's pages, scripts or cookie values. If we find a secret, we keep only its type, where it was, and its first 4 characters and length.

Questions or opting out

If you run a site and want us to stop checking it, contact us at [email protected] with the domain.