Paste the request and optional response headers to get a review report. Checks use the supplied text and do not probe the API endpoint.
Runs locally in your browserThe checker evaluates only visible copied text and rules that are safe to assess locally. It cannot discover authorization flaws, rate limits, server behavior, or vulnerabilities in a live API.
Paste the HTTP request or cURL command exactly as you copied it, and optionally the response headers. The review reads that text, applies a fixed rule set and lists what deserves a second look.
Everything is computed in the browser. The request is never sent, replayed or scanned, so copied production traffic is safe to review as long as no real credentials stay in shared text.
Transport: whether the target is https, plain http, another scheme such as ftp, or has no absolute target at all.
Credentials: secrets in the query string or in JSON and form bodies, user:password inside the URL, Basic authentication in the Authorization header or through a cURL -u flag, cookie data carried by -b, and requests to sensitive-looking paths without an Authorization or X-API-Key header.
From the response headers the review reads the CORS origin and credentials combination, the Secure, HttpOnly and SameSite attributes of every Set-Cookie value, a missing content type, a redirect to http, and technology disclosure headers such as Server or X-Powered-By.
A request with a body but no Content-Type header is reported as well, and a sensitive-looking endpoint without Cache-Control is listed as a review item.
The rules only see copied text. They cannot find authorization flaws, rate limits, server behaviour or vulnerabilities in a live API, and a clean report is not a security guarantee.
cURL flag values such as -o, -w, -u and -b are read as flag values, not as the URL, and commands that use --header=value or --data=value are understood; -I is treated as a HEAD request.