CyberChecker Update: Most sites leak more than expected
Quick update since the last CyberChecker post.
The scanner has now run 5,200+ website scans.
The pattern is becoming very clear.
Security problems are rarely dramatic.
They’re usually quiet misconfigurations that nobody notices.
What I improved
Over the past week I focused on reducing false positives and improving explanations.
One thing I realized from user feedback:
People don’t care about technical vulnerability names.
They care about “What does this mean for my site?”
So I updated the reports to include clearer explanations like:
what the issue means
why it matters
what someone could realistically do with it
Example:
Instead of:
“Missing security headers”
The report now explains:
“Your site allows the browser to load scripts from untrusted sources. This increases the risk of cross-site scripting attacks.”
Clarity makes the reports far more actionable.
Updated scan statistics (5,200+ sites)
Some numbers changed slightly.
Some didn’t.
• 91% have at least one vulnerability
• 61% expose API keys in client bundles
• 37% show signs of weak or missing Supabase RLS protection
• 31% expose configuration or backup-related files
• 19% leak internal environment information
The most common stack I see right now:
Next.js + Supabase + Vercel
Great for shipping fast.
But very easy to misconfigure.
One interesting pattern
Many founders assume:
“If my site is small, nobody will care.”
But most vulnerabilities I’m seeing aren’t targeted attacks.
They’re automated scanners scraping the web for exposed endpoints.
If something is publicly accessible, it will eventually be discovered.
Product direction
CyberChecker is still intentionally simple.
• One scan
• One report
• $39 one-time payment
No subscriptions.
No monitoring.
No dashboards.
I’ve built SaaS products before that turned into maintenance traps, and I’m trying not to repeat that mistake.
That’s interesting. Did anything in the results surprise you the mo
CyberChecker highlights a critical reality in website security—most vulnerabilities come from unnoticed misconfigurations like exposed API keys, weak Supabase RLS rules, or missing security headers. Tools that clearly explain risks and provide actionable insights help developers secure modern stacks like Next.js, Supabase, and Vercel before automated scanners exploit them.
5,200 scans already , that's serious traction. The stat that stood out to me: 61% expose API keys in client bundles. That's the kind of thing that feels invisible until it's too late.
The shift from technical vulnerability names to clear explanations is smart. Most users don't care about "CVE-2024-1234" they care about "is my site going to get hacked?" Making that connection is where the value lives.
I'm building in a similar space but different angle , FontPreview.online helps designers test fonts and check licenses. Same philosophy: cut through the jargon and give people what they actually need to know.
The one-time pricing model is refreshing. No dashboards, no subscriptions, just a clean transaction. I respect that.
Quick question: have you noticed any patterns in which API keys are most commonly exposed? Google Maps keys, Stripe keys, something else?