What Lockpick checks, one page each
Each page says what a check looks for, why it matters and how to fix it with your AI.
Connection and certificates
- Does your site load over HTTPS for every visitor?What the HTTPS check reads, what a passing result does and does not prove, and how to keep every page on an encrypted connection.
- Does your site tell browsers to always use HTTPS?The HSTS check looks for a Strict-Transport-Security header. Here is what it means when it is missing and how to add it safely.
- Does your HSTS rule cover your other subdomains too?The HSTS reach check looks at whether a long-lived Strict-Transport-Security rule includes your subdomains, and when it is safe to extend it.
- Which TLS version does your site negotiate, and is it current?The TLS version check reads which protocol version a scan connection used. Here is what a modern result does and does not prove.
- Which of your addresses does your site certificate cover?The certificate coverage check compares names in public certificate logs with the names your certificate covers, so forgotten addresses surface.
- Is your site certificate about to expire?The certificate expiry check warns when your site certificate expires within a month. Here is what to check so renewal does not lock visitors out.
- Why do visitors see a certificate warning on your site?The certificate failure check reports when a secure connection fails the checks every browser makes. Here is what each failure means and how to fix it.
Browser security settings
- Does your site send a Content Security Policy?The CSP check looks for an enforced Content Security Policy that limits where scripts load from. Here is what it shows and how to add one in steps.
- Does your Content Security Policy also lock down plugins, base and forms?This check reads three directives in an enforced CSP that are easy to miss, and explains what each one blocks and how to add them.
- Can other sites show your pages inside a frame?The framing check looks for frame-ancestors or X-Frame-Options, the settings that stop clickjacking. Here is what a missing one means and how to fix it.
- Does your site stop browsers from guessing file types?The file type check looks for X-Content-Type-Options set to nosniff. Here is what it protects against and how to add it in one line.
- How much of your page address do you share when visitors click away?The referrer check looks for an explicit Referrer-Policy. Here is what browsers do without one and which value fits most sites.
- Does your site declare which browser features it may use?The browser feature check credits a declared Permissions-Policy that limits camera, microphone and other powerful features. A missing one is never reported.
- Does your site keep windows from other sites away from it?The window isolation check credits a Cross-Origin-Opener-Policy on your pages. Absence is never scored, because popups for sign-in and payments may need it off.
Cookies and sign-in sessions
- Do the cookies on your public pages carry the right protections?The cookie flags check reads Secure, HttpOnly and SameSite on cookies your public pages set. Here is what each flag does and which cookies need them.
- Could a shared cache hand one visitor another visitor’s session?This Deep scan check reads the session address of common sign-in libraries and its cache headers. An empty answer is normal; a cacheable one needs fixing.
- Is your sign-in system handing sessions to visitors who never signed in?This Deep scan check flags a sign-in library session address that returns a real user or session to a visitor with no cookie. Treat it as urgent.
- Is your sign-in cookie missing a protection?This Deep scan check recognises the session cookie of common sign-in libraries and flags one set without Secure, HttpOnly or SameSite.
Page content and forms
- Does your secure page load anything over plain HTTP?The mixed content check reads your HTML for scripts, images and files at http addresses on an https page. Here is why it matters and how to fix it.
- Do the forms on your site send data over HTTPS?The form destination check reads where the forms on a page say they send data, and flags any plain http destination. No form is ever submitted.
- Could your login form leak passwords in the address or over HTTP?The password form check reads how a form with a password field declares it will send data, and flags plain HTTP or passwords placed in the address.
Code anyone can download
- Is a private API key sitting in your site code?The secret key check reads pages, scripts and source maps for text shaped like a private key for a known service. Here is what to do when it finds one.
- Does your browser code mix untrusted input with risky methods?This check flags scripts that both read input an attacker can control and call methods that insert or run content. It is a code review lead, not a proven bug.
- Can anyone download readable source code for your site?The public source map check reads source maps a Deep scan can download, which can reveal file names and original code. Here is when that matters.
- Do your scripts point to a source map?This check notes when a script names a source map in a header or trailing comment. The reference alone does not show the map is public.
- Is your live site serving a development build?This check flags pages that load a script or library build meant for development. Here is why it slips through and how to ship the production build.
- Do scripts from other sites carry an integrity hash?The subresource integrity check reads whether scripts and styles from other sites carry an integrity hash. Here is when to add one and when you cannot.
- Does your site load scripts from a host with a past security incident?This check matches the script hosts your pages load against published supply-chain incident reports. A match is a reason to review, not proof of harm.
Files and error pages
- Does your site show error details or stack traces to the public?The error output check flags responses that show stack traces or debug output from your server. Here is what they reveal and how to turn them off.
- Does your server list the files in a folder to anyone?The folder listing check flags pages that are automatic listings of a server folder. Here is why they matter and how to turn listings off.
- Are settings or deployment files readable on your live site?The deployment file check, in Deep scans, looks for configuration, build and history files served at public addresses, confirmed by their content.
APIs
- Is your API description public, and does it match your API?This Deep scan check reads public API descriptions such as OpenAPI documents, and which operations they say need sign-in. A description proves nothing about enforcement.
- Is your interactive API documentation open to anyone?This Deep scan check flags interactive API documentation reachable without signing in. It is reconnaissance value for attackers, not a flaw on its own.
- Does your site let other websites read responses with your visitors’ cookies?The CORS check sends one request with an unrelated origin and flags a response that trusts it while allowing credentials. Here is why that matters.
- Does an API route on your site answer without signing in?This Deep scan check sends one read-only request with no cookie, token or key to API routes your site uses, and flags any that return data.
- Does your API skip the sign-in its documentation promises?This Deep scan check flags an operation your API description marks as protected that still returns data without sign-in. One of the two is wrong.
- Can anyone list your GraphQL schema?This Deep scan check sends one introspection request with no credentials and notes when a GraphQL endpoint lists its operations to anyone.
- Do your API responses send the right protective headers?This Deep scan check reads JSON responses from your API for nosniff, cache rules on personal data and a restricted cross-origin rule.
Databases and backends
- Can anyone read your Supabase tables with the public anon key?This Deep scan check reads tables your site code names with the public anon key and flags any that return rows. Here is what that does and does not prove.
- Can anyone read your Firebase Realtime Database?This Deep scan check sends one shallow public read to the Firebase Realtime Database your site uses and flags it when entries come back.
- Do your Convex functions return data to anyone who calls them?This Deep scan check calls Convex query functions your site code uses, with no sign-in and no arguments, and flags any that return data.
- Does your domain publish an SPF record that refuses unknown senders?The SPF check reads whether your mail domain publishes one SPF record ending in a soft fail or hard fail. Here is what that does and what it leaves out.
- Why does Lockpick report DKIM as not tested?DKIM needs a selector and a signed message to verify, so a scan reports it as not tested instead of guessing. Here is how to check it yourself.
- Can anyone send email that looks like it came from your domain?The email spoofing check reads your DMARC policy to see whether mail servers are told to stop fake mail from your domain. Here is how to close the gap safely.
- Would you find out if someone faked email from your domain?The DMARC reports check reads whether your DMARC record names an address for aggregate reports, so spoofing and broken senders do not stay invisible.
- Is your SPF record broken or too permissive?The broken SPF check finds duplicate SPF records, ones that let any sender pass, and ones over the DNS lookup limit. Here is how to repair each.
Your domain and subdomains
- Is DNSSEC turned on for your domain?The DNSSEC check reads whether your domain has a DS record at its parent zone. Here is what DNSSEC protects and why a missing one is informational.
- Does your domain say which authorities may issue its certificates?The CAA check reads whether your domain publishes a CAA record. Here is what it limits, why a missing one is informational, and how to add it.
- Which addresses on your domain are controlled by other companies?This check lists subdomains that point to services run by other companies, so each one has a known owner. Pointing elsewhere is normal; forgetting is the risk.
- Could someone take over a forgotten subdomain of yours?The subdomain takeover check flags addresses that point at a service where the account behind them looks unclaimed. Here is why it is urgent and how to fix it.
- Do your subdomains depend on a domain that is about to lapse?This check flags subdomains pointing to a domain that looks unregistered, is being deleted or expires soon, so a new owner never inherits your traffic.
- Is your own domain close to expiring or being deleted?The domain registration check reads public registry data for your domain and flags near expiry or deletion status, so renewal never fails quietly.
- Has someone registered a domain that looks like yours?The lookalike check reads public records for common variations of your domain and lists the ones that are registered. Here is what to do about them.
Sitemaps and search
- Does your sitemap point attackers to a private area?This check flags sitemap entries whose names suggest an admin, app, API or test area. Listing is not a flaw; an unprotected area would be.
- Does your site give search engines a sitemap?This search visibility check looks for a sitemap where search engines expect one. It never affects your security grade. Here is how to publish one.
- Does your robots.txt point search engines to your sitemap?This search visibility check flags a sitemap that robots.txt does not name. One line fixes it, and it never affects your security grade.
- Can search engines read your sitemap?This search visibility check flags a sitemap that breaks the sitemap format, so search engines may ignore part or all of it. It never affects your security grade.
- Does your sitemap list addresses search engines will skip?This search visibility check flags sitemap entries that are insecure, duplicated, relative or on another site. It never affects your security grade.
- Are the last-updated dates in your sitemap believable?This search visibility check flags sitemap dates that are invalid, in the future or all identical, which search engines learn to ignore.
- Does your sitemap list pages your robots.txt blocks?This search visibility check flags sitemap pages that robots.txt tells search engines to skip. One of the two lists needs changing.
Disclosure and protection
- Does your server announce its software version to everyone?The version banner check reads Server and X-Powered-By headers for exact versions. Here is why that helps attackers and why it never proves a flaw.
- Does your site tell security researchers how to reach you?The security contact check looks for a current security.txt file. Here is what it should contain and why a missing one is not a vulnerability.
- What does it mean when your firewall blocks a Lockpick scan?When your edge firewall turns a Deep scan away partway through, the report credits it as a working control. Here is what that means for your results.