Keelscan

Keelscan is a security posture scanner for teams that ship fast and then get asked to prove the result is safe. It looks at three surfaces and turns them into a single answer.

The first is your code. Keelscan finds committed secrets and credentials, API keys that end up in the client bundle, and insecure patterns in the source. It also checks your dependencies for hallucinated, typosquatted and suspiciously fresh package names, the failure mode of fast AI-assisted development, rather than matching against a CVE feed.

The second is your running application. Keelscan checks TLS, security headers, cookie flags, CORS, and files that were never meant to be reachable. A live URL is all it needs.

The third is your cloud data config, and it is the one that catches people out. Keelscan validates Supabase row-level security and public tables, and Firebase and Firestore rules. These are the mistakes that leave a database readable by anyone while the application itself works perfectly, so nothing surfaces them until someone deliberately looks.

Every scan resolves to one A-F grade, with a plain-English explanation of what an attacker could actually do and a concrete fix for each finding. The graded result becomes a report you can send to a prospect, an investor or a security reviewer, and a hosted Trust Center page you can publish at a public URL so buyers can check for themselves. Keelscan publishes its own.

Findings are mapped to the SOC 2 and HIPAA control areas they touch. These are readiness indicators to work from, not an audit and not a claim of compliance.

Paid plans add continuous posture, where connecting a repository triggers a re-scan on every push with alerts when something new appears, and a security questionnaire drafter that builds answers from your scan using questions aligned with the same control domains a SIG Lite or CAIQ review walks.

Keelscan is built for founders and small teams, especially those working on AI-assisted codebases, who have to answer "is this secure?" without a security engineer on staff. The first scan is free and needs no signup.