Check your source code
Drop the folder (or a .zip) of your website's code. Wsec reads it for hard-coded secrets, SQL injection and cross-site scripting patterns, shell commands built from strings, weak crypto, turned-off TLS checks, and risky settings in config and dependency files.
Your code is not kept. Files are sent to this server, analysed in memory and thrown away. No report is saved and there is no link to share. Secrets found in the code are shown only as the first few characters. If you would rather not upload it at all, run Wsec on your own machine, as the README describes.
Results
What this can and cannot do
- It matches patterns line by line. It finds the common, obvious mistakes. It does not follow data from a request to a database call, so it will miss bugs that are spread over several lines or files, and logic errors such as missing permission checks.
- Some matches are lookalikes. Each finding says how sure the rule is (high, medium or low confidence). Read the line before changing anything.
- It looks up known vulnerabilities in dependencies via the OSV database when a lockfile or pinned requirements file is present. Coverage is not complete; also run
npm audit,pip-auditorosv-scannerin CI. - A clean result means none of these patterns matched. It does not mean the code is secure.
Limits
Loading...