CyberChecker

Quick update since the last CyberChecker post.

The scanner has now run 5,200+ website scans.

The pattern is becoming very clear.

Security problems are rarely dramatic.

They’re usually quiet misconfigurations that nobody notices.

What I improved

Over the past week I focused on reducing false positives and improving explanations.

One thing I realized from user feedback:

People don’t care about technical vulnerability names.

They care about “What does this mean for my site?”

So I updated the reports to include clearer explanations like:

• what the issue means

• why it matters

• what someone could realistically do with it

Example:

Instead of:

“Missing security headers”

The report now explains:

“Your site allows the browser to load scripts from untrusted sources. This increases the risk of cross-site scripting attacks.”

Clarity makes the reports far more actionable.

Updated scan statistics (5,200+ sites)

Some numbers changed slightly.

Some didn’t.

• 91% have at least one vulnerability
• 61% expose API keys in client bundles
• 37% show signs of weak or missing Supabase RLS protection
• 31% expose configuration or backup-related files
• 19% leak internal environment information

The most common stack I see right now:

Next.js + Supabase + Vercel

Great for shipping fast.

But very easy to misconfigure.

One interesting pattern

Many founders assume:

“If my site is small, nobody will care.”

But most vulnerabilities I’m seeing aren’t targeted attacks.

They’re automated scanners scraping the web for exposed endpoints.

If something is publicly accessible, it will eventually be discovered.

Product direction

CyberChecker is still intentionally simple.

• One scan
• One report
• $39 one-time payment

No subscriptions.

No monitoring.

No dashboards.

I’ve built SaaS products before that turned into maintenance traps, and I’m trying not to repeat that mistake.

Quick update since my last posts.

CyberChecker has now scanned just over 4,100 sites.

The numbers haven’t improved.

But what has improved is the product.

What’s new

I expanded the Supabase detection logic.

Before, it only flagged obvious exposed anon keys and missing RLS patterns.

Now it:

• Detects Supabase projects more reliably (even when partially obfuscated)
• Checks for signals of permissive or missing RLS policies
• Flags risky public endpoints
• Adds clearer explanations of what “RLS misconfigured” actually means in practice

Supabase is incredibly popular with indie hackers, and it’s also the most common source of silent data exposure I’m seeing.

Updated stats (4,100+ scans)

• 92% have at least one vulnerability
• 63% still expose API keys in client bundles
• 38% show signs of weak or missing RLS protection
• 29% expose config or backup-related files

The Supabase number surprised even me.

What I’m noticing

Security still doesn’t sell by itself.

But when someone sees:

“Your Supabase database could likely be queried without proper row filtering”

They act.

Clarity > fear.

Revenue side

Still $39 one-time.

Still no subscription.

Revenue crossed $3k total.

Conversion rate stable around ~8%.

I’m resisting the urge to turn this into a monitoring SaaS.
Every time I overcomplicated a project in the past, I killed it.

Last time I posted, I had just launched CyberChecker and shared some early stats. Since then I’ve kept scanning sites, talking to founders, and honestly… learning more about how people actually think about security (spoiler: mostly they don’t).

A few things that surprised me lately:

→ Founders don’t ignore security because they don’t care — they ignore it because it feels overwhelming. When reports are too technical, they just close the tab. When fixes are simple and clear, they act.

→ Performance and SEO issues often convert better than “security” alone. People want protection, but they buy visibility, speed, and peace of mind.

→ Trust matters more than features. Showing exactly what was scanned, how, and why reduced skepticism way more than adding new checks.

What’s working for growth right now:

• Mostly organic SEO + founder communities
• Direct outreach when I find serious issues (carefully, not spammy)
• Partnerships with people running directories or SaaS tools
• Sharing real scan stories instead of generic marketing

Still no paid ads.

Product side changes:

• Improved false-positive filtering (big trust boost)
• Clearer remediation steps for non-technical users
• Faster average scan time
• More context around severity (“should I panic or schedule this?”)

What I’m debating next:

Continuous monitoring vs one-time scans

Keeping it security-only vs broader “site health”

Whether to build integrations or stay simple

Pricing — staying accessible vs signaling higher value

Honestly, I’m trying not to overbuild. Every indie project I messed up before died from complexity, not lack of features.

Curious:

How do you personally handle security for your projects?
Ignore it, DIY it, outsource it, or automated tools?
And if you built a dev tool,what growth channel actually worked for you?

I was doing freelance security audits and kept finding the same issues everywhere: exposed Stripe keys in JavaScript bundles, missing security headers, .env files publicly accessible, Supabase projects with zero Row Level Security. Basic stuff that takes 5 minutes to fix but somehow exists in production everywhere.

The kicker? I ran my own SaaS through the checks and found 6 critical issues I had no idea about. Exposed API key in my React bundle that had been there for 3 months. Felt like an idiot.

What I built:

Automated security scanner that runs 50+ checks in ~60 seconds:

• SSL/TLS configuration (cert expiration, protocol versions, HSTS)

• Security headers (CSP, X-Frame-Options, CORS misconfigs)

• Exposed secrets (API keys, credentials, connection strings)

• OWASP Top 10 (SQL injection patterns, XSS vectors, CSRF)

• Database security (Supabase RLS, exposed credentials)

• Sensitive file exposure (.env, .git, backups)

Tech stack:

• Next.js + Vercel Edge (battled the 10s timeout limit)

• Supabase for report storage

• Custom Node.js scanners (no third-party APIs)

• Stripe for payments ($39 one-time, no subscription)

The scary stats:

Scanned 2,847 sites so far. Results:

• 94% have at least one vulnerability

• 67% have exposed API keys in client code

• 41% vulnerable to SQL injection

• 34% have publicly accessible config files

Most common issue? Supabase anon keys with no RLS policies. Instant database dump.

Business model:

Free preliminary scan shows vulnerability count by severity. Full report with exact locations + copy-paste fixes: $39 one-time payment. No subscription, no SaaS lock-in.

Launched 3 weeks ago, done $2,340 in revenue so far. Conversion rate sitting at 8.7% (free scan → paid report).

What I learned:

1. False positives kill trust - Spent 60% of dev time reducing these. Had to add context validation, not just regex pattern matching.

2. People pay for clarity, not data - Early version just listed issues. Nobody converted. Added exact line numbers, code snippets, step-by-step fixes. Conversion jumped from 2% to 8%.

3. Secrets detection is harder than it looks - Can't just grep for "api_key". Had to build entropy analysis + context checking. Still not perfect.

4. Marketing > product - Built this in 2 weeks. Spent 3 weeks figuring out how to explain why people should care. Turns out "your site is vulnerable" doesn't work. "Here's the exact exposed Stripe key that could bankrupt you" does.

Current challenges:

• Scaling is tricky (each scan takes 30-60s of compute)

• Some sites block the scanner (rate limits, Cloudflare)

• Explaining technical results to non-technical founders

• Debating whether to add continuous monitoring (monthly SaaS model)

What's next:

Thinking about adding:

• Scheduled scans (alert when new vulns appear)

• Team accounts (scan all your domains)

• API access for CI/CD integration

• Comparison view (track security over time)

But also wondering if I should just keep it simple and focus on acquisition instead.

Questions for you:

1. Would you pay for continuous monitoring vs one-time scans?

2. Is $39 too cheap? (Some people assume it's low quality because of the price)

3. Any indie hackers want to swap scans? I'll run yours free if you give feedback