Launched CyberChecker: Found critical vulnerabilities in 94% of sites scanned (including my own)

I was doing freelance security audits and kept finding the same issues everywhere: exposed Stripe keys in JavaScript bundles, missing security headers, .env files publicly accessible, Supabase projects with zero Row Level Security. Basic stuff that takes 5 minutes to fix but somehow exists in production everywhere.

The kicker? I ran my own SaaS through the checks and found 6 critical issues I had no idea about. Exposed API key in my React bundle that had been there for 3 months. Felt like an idiot.

What I built:

Automated security scanner that runs 50+ checks in ~60 seconds:

• SSL/TLS configuration (cert expiration, protocol versions, HSTS)

• Security headers (CSP, X-Frame-Options, CORS misconfigs)

• Exposed secrets (API keys, credentials, connection strings)

• OWASP Top 10 (SQL injection patterns, XSS vectors, CSRF)

• Database security (Supabase RLS, exposed credentials)

• Sensitive file exposure (.env, .git, backups)

Tech stack:

• Next.js + Vercel Edge (battled the 10s timeout limit)

• Supabase for report storage

• Custom Node.js scanners (no third-party APIs)

• Stripe for payments ($39 one-time, no subscription)

The scary stats:

Scanned 2,847 sites so far. Results:

• 94% have at least one vulnerability

• 67% have exposed API keys in client code

• 41% vulnerable to SQL injection

• 34% have publicly accessible config files

Most common issue? Supabase anon keys with no RLS policies. Instant database dump.

Business model:

Free preliminary scan shows vulnerability count by severity. Full report with exact locations + copy-paste fixes: $39 one-time payment. No subscription, no SaaS lock-in.

Launched 3 weeks ago, done $2,340 in revenue so far. Conversion rate sitting at 8.7% (free scan → paid report).

What I learned:

1. False positives kill trust - Spent 60% of dev time reducing these. Had to add context validation, not just regex pattern matching.

2. People pay for clarity, not data - Early version just listed issues. Nobody converted. Added exact line numbers, code snippets, step-by-step fixes. Conversion jumped from 2% to 8%.

3. Secrets detection is harder than it looks - Can't just grep for "api_key". Had to build entropy analysis + context checking. Still not perfect.

4. Marketing > product - Built this in 2 weeks. Spent 3 weeks figuring out how to explain why people should care. Turns out "your site is vulnerable" doesn't work. "Here's the exact exposed Stripe key that could bankrupt you" does.

Current challenges:

• Scaling is tricky (each scan takes 30-60s of compute)

• Some sites block the scanner (rate limits, Cloudflare)

• Explaining technical results to non-technical founders

• Debating whether to add continuous monitoring (monthly SaaS model)

What's next:

Thinking about adding:

• Scheduled scans (alert when new vulns appear)

• Team accounts (scan all your domains)

• API access for CI/CD integration

• Comparison view (track security over time)

But also wondering if I should just keep it simple and focus on acquisition instead.

Questions for you:

1. Would you pay for continuous monitoring vs one-time scans?

2. Is $39 too cheap? (Some people assume it's low quality because of the price)

3. Any indie hackers want to swap scans? I'll run yours free if you give feedback