Does a good grade mean my app is secure?

No. Headers and HTTPS protect the page itself. Most leaks in AI-built apps are in the server and database: missing ownership checks, open tables and exposed keys. Use the other free tools and the audit prompt for those.

Is it safe to check for .env files?

The check asks for a few well-known file paths, exactly as any visitor could, and only reports whether a real file came back. It never shows or stores the contents.

Why do I need a Content Security Policy?

If an attacker gets a script into your page, through a comment, a profile field or an upload, the policy is what stops it running. Start in report-only mode so nothing breaks while you tune it.

What grade does your site get?

HTTPS, the security headers browsers rely on, cookie settings, and the files that must never be public. One check, an A to F grade, and the fix for each gap.

Finds exposed .env and .git files
Checks HTTPS, headers and session cookies
Free, no sign-up

What it checks

Exposed files. A .env file holds every secret your app uses; a .git folder holds your whole code history. Either one being downloadable is the worst finding a site can have.

HTTPS and HSTS. Encryption for every request, and a promise to browsers never to use plain HTTP for your site.

Content Security Policy and framing. Limits on which scripts may run, and on which sites may show your pages in a frame.

Cookies. Session cookies should be Secure, HttpOnly and SameSite, so scripts and other sites cannot use them.

How to fix the common gaps

Exposed .env or .git: block them at your host, then rotate every key they contained. Removing the file is not enough.
Missing headers: most hosts (Vercel, Netlify, Cloudflare) set them in one config file; ask your AI to add them.
Session cookies: set Secure, HttpOnly and SameSite=Lax where the cookie is created.
Run the check again to confirm the grade.

Questions

Does a good grade mean my app is secure?: No. Headers and HTTPS protect the page itself. Most leaks in AI-built apps are in the server and database: missing ownership checks, open tables and exposed keys. Use the other free tools and the audit prompt for those.
Is it safe to check for .env files?: The check asks for a few well-known file paths, exactly as any visitor could, and only reports whether a real file came back. It never shows or stores the contents.
Why do I need a Content Security Policy?: If an attacker gets a script into your page, through a comment, a profile field or an upload, the policy is what stops it running. Start in report-only mode so nothing breaks while you tune it.