How Lockpick checks a site
What Pulse and Deep look at, what they leave alone, and how to read a result.
Watch the walkthrough
Four minutes with Pick, from adding your site to handing the fix to your AI. Captions are on screen, so it works with the sound off.
Read the transcript
- 0:00 Meet Lockpick
- Pick introduces Lockpick. It reads your live site from the outside, the way a stranger would, and never needs your code.
- 0:44 Add your site
- Add your site by its address and confirm you own it or are allowed to test it.
- 1:26 Your first scan
- Run your first Pulse scan. It reads your homepage and public records, usually in under 15 seconds, and changes nothing on your site.
- 2:19 Read your report
- Read the grade, then each finding in plain words, with the evidence behind it and what someone could do with it.
- 3:10 Fix it with your AI
- Copy a finding’s fix prompt into your coding assistant, review and test the change, then Check again to confirm the fix.
Pulse and Deep
Two depths of the same outside look. Pulse is free on every plan. Deep comes with the Deep plan and goes much further, on sites you have proven you own.
Pulse
A quick outside look, the way a stranger or a bot sees your site
- What we look at
- The homepage and the files it loads, email sender settings (SPF and DMARC), security headers and TLS, and public DNS, certificate and subdomain records, in at most 12 requests. It also checks whether two files that should never be public, /.env and /.git/HEAD, can be downloaded.
- How long
- Usually under 15 seconds
- Needs proof you own it
- No, just confirm you're allowed
Deep
A careful walk through your site, the way a determined attacker would
- What we look at
- Up to 30 readable pages and 20 scripts, files that should not be public, admin areas, and your API if you have one. If your site builds its pages in the browser, the report says how much Deep could read.
- How long
- 2 to 8 minutes
- Needs proof you own it
- Yes, a DNS record, a meta tag or a file, kept published
Neither one changes anything on your site.
From finding to fix
Every scan ends in the same loop, so you know when a problem is really gone.
Scan
Run a Pulse or Deep scan, or let a weekly auto-check run one for you.
Read the finding
Each finding says in plain words what is open, what someone could do with it and the evidence we saw.
Hand the fix to your AI
Copy the fix prompt into Lovable, Bolt, Replit, Cursor or Claude Code. Review and test the change before you deploy it.
Check again
Check again runs the same scan to confirm the fix. It uses one scan from the month’s allowance.
For a DNS finding, Re-read this record reads the public record again for free, without a new scan.
Auto-checks
Turn on an auto-check and Lockpick scans your site on a schedule, then emails you the grade, what was fixed, what is new and the one thing to fix first. The Free plan checks weekly with Pulse. The Deep plan checks daily with Pulse and weekly with Deep.
On the Free plan each auto-check uses one scan from the month’s allowance, the same as a scan you start. On Deep, daily Pulse auto-checks are included and use no scans, and Deep auto-checks use Deep scans. A daily Pulse auto-check emails you only when a new urgent issue appears, unless you choose an email after every check. When the scans run out, auto-checks that need them wait for the reset and email you.
Questions
Which websites can I assess?
Only sites you own or are authorized to test. Check the exact HTTPS origin before starting. Permission for one site does not include other domains, shared hosting infrastructure or third-party services.
Do I need to understand security?
Start with the plain-language explanation, then open the evidence if you need more detail. Your coding agent can help with a repair, but you should review and test the proposed change.
Does my coding agent run the scan?
Lockpick runs the scan on its own infrastructure. Your coding agent can help apply the fix prompt in your repository. Your results show the evidence and next steps. Private workflows and internal logs are not part of the report.
What does Pulse look at?
The homepage and the files it loads, email sender settings (SPF and DMARC), security headers and TLS, and public DNS, certificate and subdomain records, in at most 12 requests. It also checks whether two files that should never be public, /.env and /.git/HEAD, can be downloaded. It does not sign in, submit forms, access your database or prove that user roles are isolated. Deep goes further, up to 30 readable pages and 20 scripts plus your API, once you prove you own the site. When a site builds its pages in the browser, the report shows how much Deep could read.
Does Lockpick follow robots.txt?
Pulse reads one page, the homepage a visitor opens, and the files it loads, the way a visitor’s browser does. It also reads robots.txt, your sitemap and security.txt, and never crawls any other page. It also checks whether two files that should never be public, /.env and /.git/HEAD, can be read, and skips either one when robots.txt asks crawlers to stay away from it. Deep reads robots.txt for discovery only. Its Sitemap directive and the routes it names guide what Deep checks, but Deep still requests routes the file disallows, because robots.txt is a request to well-behaved crawlers, not access control. Deep runs only on sites you have proven you own.
Does a clean result mean my app is secure?
No. It means the completed checks did not observe a concern in the sampled response. Unknown checks and untested areas remain visible. A public homepage check cannot establish the security of the whole application.
Will Lockpick change my code?
No changes are made automatically. Review the fix prompt with your coding agent, test the proposed fix, and decide whether to deploy it. Copying a prompt does not resolve a finding. Check again to compare new evidence.
What happens if the scan stops early?
If a scan stops early, the report marks which checks finished and which did not. A partial result never shows as clean.
Can I keep the results forever?
Reports stay in your workspace until you delete them or close your account. Never put passwords, access tokens or customer data in a target URL or repair brief.
Sources
The live vulnerability count on the home page starts from Zero Day Clock, which counted 57,871 CVEs published from January to August 2026. We extend it at the same daily rate.
See what your site shows
Start with a free look at your homepage, then decide how far to go.