What is Lockpick
Lockpick checks what anyone online can see about your website and tells you, in plain words, what to fix.
Lockpick looks at your website from the outside, the way a stranger, a bot or an attacker would see it. It reads what your site shows to anyone on the internet, finds the gaps that make common attacks easier, and explains each one in plain words with a fix you can hand to your developer or your coding assistant.
It never logs in to your site, never sends attack payloads, never fills in your forms and never needs your code. A repository or skill check reads public GitHub code and never runs it. Every check has a fixed limit on how many requests it sends, and it stops early if your site asks it to slow down.
What you can do with it
A quick check
A score out of 100 for your homepage in about 10 seconds. No account needed.
Your first Pulse scan
A fuller outside look at your homepage, email settings, security settings and public records, usually in under 15 seconds.
A Deep scan
A careful walk through up to 30 pages of a site you have proved you own.
Fix and check again
A fix for every issue, a prompt for your coding assistant, and a way to confirm the fix worked.
You can also have Lockpick check a site every week and email you the result, like antivirus for your website, and you can use it from Claude, ChatGPT, Cursor and other assistants.
What a result means
A Lockpick result tells you what we found in what we checked. It is not a certificate and it is not a full penetration test. When a scan finds nothing, the result reads "No issues found in what we checked", and every report shows exactly what that covered.
Where to start
Was this helpful?