Before launch day: using Scan.now as one layer in an AI product security check
Scan.now offers free passive website checks and exposed-key detection, but it is not a penetration test. This article explains how workers can use it as one layer in an AI product security review, with a practical protocol and remediation order.
You are about to launch an AI product. The team has tested the model, written the prompts, and locked the API keys. But on launch day, a reporter runs a simple scan and finds an exposed key in your source map. Your product is now a case study in someone else's blog. This scenario is common, and it is avoidable. Before launch day, you can run a free, passive scan using Scan.now to catch low-hanging security issues that automated attackers and curious users will find first.
The problem: leaks that do not require a hacker
Many AI products rely on API keys, tokens, and secrets embedded in client-side code or configuration files. A single exposed key can give an attacker access to your language model endpoint, database, or cloud storage. You do not need a sophisticated penetration tester to find these leaks. Public scanners can detect them by reading your website's HTML, JavaScript, and source maps. The risk is especially high for small teams in Hong Kong, where rapid prototyping and tight deadlines sometimes mean security checks are deferred until after launch. A passive scan before launch can reveal these issues without any risk of exploitation.
What Scan.now does and does not do
Scan.now is a free online scanner that runs 60 passive checks on any public website. It checks security headers, TLS configuration, cookie flags, exposed files, mixed content, outdated JavaScript libraries, and email spoofing protection. It also includes an LLM API Key Scanner that checks public HTML, same-origin JavaScript, and linked source maps for exposed keys. Any match is redacted and never validated. The scanner grades the site from A to F and provides a fix for every finding.
Scan.now is not a penetration test. It does not exploit vulnerabilities, attempt to log in, or probe for business logic flaws. It is a read-only, non-intrusive scan. This means it is safe to run on any site you own or have permission to test. It will not cause downtime or trigger alarms. However, it will not find every vulnerability. It will not test authentication, authorisation, or session management. It will not simulate an attacker's behaviour. For a full security assessment, you still need a human-led penetration test. Scan.now is a useful first layer, not a replacement.
How to run a useful scan before launch
To get the most out of Scan.now, follow this protocol. First, ensure you have permission to scan the target site. If you are a worker on a product team, confirm with your manager or security lead. Second, open the website scanner at scan.now and enter the full URL of your product's public-facing site. Third, run the scan and wait for the results. Fourth, review each finding. Scan.now provides a plain-language explanation and a fix for every issue. Fifth, run the LLM API Key Scanner separately. Enter the same URL and check for exposed keys in source maps and JavaScript files. Sixth, document all findings in a shared issue tracker or spreadsheet. Seventh, prioritise fixes using the remediation order below.
This protocol is transparent and repeatable. You can run it as many times as you like, and you can integrate it into your pre-launch checklist. It does not require special training or a security budget.
Remediation order: fix the critical risks first
When you receive the scan results, do not fix every issue in the order they appear. Use this remediation order, adapted from the NIST Cybersecurity Framework's Identify and Protect functions. First, fix exposed secrets. If the LLM API Key Scanner finds a redacted match, assume the key is compromised. Rotate the key immediately and check for any unauthorised usage. Second, fix missing security headers. Headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security prevent common attacks. Add them to your web server configuration. Third, fix TLS configuration issues. Ensure your certificate is valid, your protocol versions are modern, and your cipher suites are strong. Fourth, fix cookie flags. Set Secure, HttpOnly, and SameSite attributes on all cookies. Fifth, fix outdated JavaScript libraries. Update any library with a known CVE. Sixth, fix mixed content warnings. Ensure all resources load over HTTPS. Seventh, fix email spoofing protection. Configure SPF, DKIM, and DMARC records for your domain.
This order focuses on the issues most likely to cause a breach or reputational damage. It aligns with the CISA Secure by Design principle that security should be built in, not bolted on.
Privacy and security considerations
Scan.now states that it does not store uploaded files and that website scans are read-only. The LLM API Key Scanner redacts any match and never validates the key. This means the scanner does not attempt to use the key, which is good for your privacy. However, you should still avoid scanning sites that contain sensitive data you cannot afford to expose. If your staging site contains real user data, do not scan it with a public tool. Use a local scanner or a private instance instead. Also, note that Scan.now records scan activity. The live scan activity page shows censored targets and source IPs. If you are concerned about anonymity, use a VPN or run the scan from a non-identifying network.
Practical workplace application
For workers on AI product teams, Scan.now can be part of a pre-launch security checklist. Assign one team member to run the scan 48 hours before launch. Include the results in the launch decision meeting. For managers, require a scan report as part of the go-live approval process. This creates a culture of security awareness without slowing down development. For freelancers and contractors building AI tools for clients, offer a scan as a value-add service. It shows professionalism and reduces liability. In Hong Kong, where data protection laws are tightening, a documented scan can also serve as evidence of due diligence.
Checklist for a pre-launch scan
- Confirm you have permission to scan the target site.
- Open Scan.now and run the Website Scanner on your public URL.
- Review each finding and read the explanation.
- Run the LLM API Key Scanner on the same URL.
- Document all findings in a shared tracker.
- Fix exposed keys first, then security headers, TLS, cookies, libraries, mixed content, and email security.
- Re-run the scan after fixes to confirm resolution.
- Include the scan report in your launch documentation.
Scan.now is a free, fast, and safe way to catch common security issues before launch. It is not a silver bullet, but it is a practical first layer. Use it, fix what it finds, and then schedule a proper penetration test for the deeper risks. Your launch day will be calmer, and your users will be safer.
Sources and further reading
- Scan.now AI website security scanner
- NIST: Cybersecurity Framework
- OWASP: Top 10 for LLM Applications 2025
- CISA: Secure by Design
Product features and terms can change; check the provider's current information before using a service for workplace material.