Small print

What Seatrial checks

Every check below runs on the plan you are on. This list is built from the scanners’ own rule lists, so it changes when they do.

See what Seatrial found when it checked itself

Your website

  • Security settings your site sends to browsers, such as the ones that stop it being framed or sniffed
  • Your HTTPS certificate and encryption, including when it expires
  • Whether every page is sent over HTTPS
  • Whether sign-in cookies are protected from theft
  • Whether other websites can read your app’s data through a visitor’s browser
  • Whether browsers are told where to report attacks on your site
  • Private files left where anyone can download them, such as backups, settings and source code
  • Which server software your site runs, and whether that version is out of date or known to be vulnerable
  • Whether your Supabase database lets strangers read or change data
  • Who can read your app’s data: open databases, data routes and what they answer
  • The email settings that stop others sending mail in your name
  • Your domain itself: unused subdomains someone could take over, renewal, and lookalike domains
  • The code your site sends to browsers: readable source maps, test builds, unsafe password forms
  • Links on your site that can send visitors, or their sign-in, to someone else’s website

Your code

  • Keys and passwords written into the code, or private keys used where browsers can see them
  • Pages and API routes that change data without checking who is asking
  • Database queries, page content and commands built straight from what users type
  • API routes with no rate limit, open cross-site access, or that save any field sent to them
  • Common logic mistakes: sign-in errors that reveal accounts, unlimited code guesses, balance races
  • Weak hashing, encryption and random numbers
  • Uploads that accept any file type or size, or trust the file name
  • Security settings missing from the app’s own configuration
  • Secrets in logs, error details sent to users, and admin actions nobody records
  • AI features that can be steered by what users or outside content say
  • Common Django, Flask and FastAPI settings mistakes
  • Programs or downloads hidden in a repository beside clean code
  • Known-vulnerable packages, a missing lockfile, and install scripts
  • Leaked keys and passwords in any file, in any language
  • Every package in every lockfile, against the public vulnerability database
  • Database queries built from user input, in any common web stack
  • Admin routes anyone can call without signing in
  • Server code that fetches any address a visitor sends it
  • Routes that write with the database master key and never check who is asking
  • Supabase tables your migrations leave open to anyone
  • Supabase edge functions that accept calls with no sign-in and no other secret
  • Keys and passwords left in your Git history, even after they were deleted, on connected repositories
  • Dockerfiles, Terraform, Kubernetes and Helm settings that weaken security
  • GitHub Actions workflows that run untrusted code or text, or use unpinned outside actions

Your packages

  • Packages your code uses, against the public vulnerability database (OSV) and the list of vulnerabilities attackers are using now (CISA)
  • New advisories against packages a watched repository already uses, rechecked between scans

What it does not check

  • Pages behind a sign-in: Seatrial never logs in to your app
  • Hands-on hacking: it does not try to break in, guess passwords or overload your site
  • Servers, cloud accounts and networks beyond the site and code you give it
  • Every logic mistake: it flags common ones, not whether your business rules are right
  • A clean result means none of these checks found a problem, not that nothing could go wrong