4 scan credits included

Remedix security scanner

Scan a deployed app. Get evidence, confidence, and fixes you can verify.Check a deployed app for exposed files, client-side secrets, unsafe browser policy, weak session signals, and public service configuration. Every result includes the observed endpoint, confidence, and a concrete fix.

Evidence-backed findings

AI-ready fixes

CLI, API, MCP

How it works

Choose scan profileIncluded on signup

MonitorSafe production checksVerifiedDeeper active checks

Public app URL

Monitor uses rate-limited HTTP, browser, bundle, exposure, and safe template checks.

I own this target or have explicit permission to test it.

SampleView sample

New accounts include enough credits for a scan, fix prompt, and verification rescan.

Rate-limited and non-destructiveInspect a complete sample report

Observable coverage

See exactly what the scanner checked and observed.

Remedix grounds findings in evidence from your deployed application, with observed signals clearly separated from corroborated and confirmed results.

Browser and transport policy

CSP, clickjacking protection, HSTS, TLS certificate health, cookie flags, CORS, and disclosure headers.

Missing CSPWeak HSTSReflected CORS

Public files and client bundles

Exposed environment files, Git metadata, source maps, stack traces, lockfiles, and secret-like values shipped to browsers.

Public source mapExposed .envClient-side key

Routes and public services

Crawled pages, robots and sitemap paths, common debug endpoints, public API responses, and selected Supabase or Firebase exposures.

Debug endpointPublic schemaSensitive JSON

Authenticated and API surface

Optional bearer, custom-header, login-form, and OpenAPI context for checks that need more than the public homepage.

OpenAPI routesSession checksBounded probes

Evidence-led prioritization

Reports that help you make informed decisions and address critical issues.

Each finding includes the observed endpoint, request method, source, confidence, verification state, evidence, and remediation guidance. Review false positives to keep the risk score focused on actionable work.

Inspect sample report How checks work

Missing HSTS Header

Medium

Verification

Corroborated

Confidence

90%

Source

Passive HTTP

Method

GET

Endpoint

https://your-app.com/

Observed evidence

Strict-Transport-Security header missing

Recommended fix

Add a long-lived HSTS policy after confirming HTTPS is stable across the domain and its subdomains.

The repeatable value

Scan, fix, and prove the change.

Observe

Run Monitor for a production-safe baseline or Verified when bounded active checks are approved.

Fix

Turn the prioritized findings into one copy-ready prompt for Cursor, Claude, Copilot, or Windsurf.

Prove

Rescan the same target and see whether risk and finding counts moved in the right direction.

CI or local terminal

CLI

# Run and wait for a release check

npx @remedix/cli scan https://your-app.com --wait --mode FAST

API

CLI

MCP

Simple entry points

Start free. Pay for the cadence you need.

New accounts receive 4 credits. Keep a one-off launch audit or move to monthly refills when rescanning becomes part of every release.

Occasional release

Launch Pass

One paid launch audit without a subscription.

€10

5 credits, no subscription

Enough for a scan, fix prompt, and verification
Credits stay available until used
Launch Report available for €9

Choose one-time

Repeat releases

Builder

For one app that needs regular launch checks.

€15/month

40 credits refilled monthly

Lower cost per repeat scan
Launch Reports included
API, CLI, and MCP access

Compare monthly plans

Questions before your first scan

Can I scan production?+

Monitor is rate-limited and designed around passive HTTP, browser, bundle, exposure, and safe template checks. Use Verified on staging or only where bounded active checks are explicitly authorized.

Does a finding mean the issue is exploitable?+

Each finding shows its verification level, confidence, source, endpoint, and evidence so you can distinguish an observed signal from a corroborated or confirmed issue.

When does a subscription make sense?+

Subscriptions are for repeat release checks: credits refill monthly, Launch Reports are included, and the per-scan cost is lower. One-time packs remain available for occasional audits.

Can Remedix run in my development workflow?+

Yes. The same scan workflow is available through the web app, API, CLI, and MCP integration.

Run a baseline before the next deploy.

Start with the public URL. Add auth or OpenAPI context only when the surface requires it.

Start a scan