I built SafeCheck after finding security holes in my own products

As an indie maker, I’ve always focused on building fast, shipping faster, and iterating after launch.

But a while back, while testing one of my own products, I found exposed API keys and misconfigured headers, things that could’ve been exploited if someone had just looked a little deeper.

That was the wake-up call.
I realized that many indie hackers (like me) skip over security because:

• It’s complicated

• It’s expensive

• Or we just assume “we’re too small to be targeted”

So I started working on SafeCheck , a simple, affordable security scanner made specifically for indie projects and small startups.

🔍 What it does:

• Scans your website for common issues like:

  • Exposed secrets (API keys, tokens)

  • Insecure SSL/TLS configs

  • Missing or misconfigured security headers

  • Exposed files (env, backups, credentials)

  • WordPress-specific issues

  • Stripe & Supabase config problems

  • Basic OWASP checks

• Generates a clear PDF report with everything it found

• No login, no subscription, no data stored — just pay once and get results

💸 The full scan is $19 one-time — because I wanted it to be accessible to everyone building on the web.

SafeCheck won’t replace professional pentesting, but it will give you peace of mind and help catch issues before launch (or worse… after it).

Would love to hear what features you think would be useful to add, especially things that don’t make the tool overly complex or expensive.

Check it out here: https://www.safecheck.dev