How SafetyScan works

SafetyScan is a public website scanner. It is designed to help operators find misconfigurations and known framework CVEs without attacking the target.

What we send

• GET the homepage (following a few public redirects)
• GET well-known paths like /.env and /.well-known/security.txt
• When Next.js is detected, a documented safe RSC crash probe for CVE-2025-55182. That probe does not execute operating-system commands.
• A TLS handshake to read certificate dates
• Pro modules (always executed for an honest grade): cookie flags, CORS, CSP quality, mixed content, leftover backups, JS library versions, CMS markers, SPF/DMARC, and a conservative Next.js middleware-header check on the homepage only

What we never do

• Remote code execution or shell commands on the target
• Dumping environment variables, passwd files, or SSH keys
• Emailing webmasters you did not explicitly choose
• Scanning private networks, localhost, or non-80/443 ports

User-Agent

Requests identify us as SafetyScan/1.0 (+/about) so operators can see who connected.

React2Shell

CVE-2025-55182 is a critical RCE in React Server Components. Patched Next.js releases include 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7 (or later in those lines). If SafetyScan reports vulnerable, upgrade immediately and rotate secrets if the app was public while unpatched.

Free vs Pro

The letter grade includes every check. Basic evidence is free. Pro evidence (exact leftover paths, cookie names, library versions, DNS records) is locked until you unlock that report or subscribe. Unlocking a report makes the shareable URL fully visible so you can send it to a webmaster.