How SafetyScan works

SafetyScan is a public website scanner. It is designed to help operators find misconfigurations and known framework CVEs without attacking the target.

What we send

• GET the homepage (following a few public redirects)
• GET well-known paths like /.env and /.well-known/security.txt
• When Next.js is detected, a documented safe RSC crash probe for CVE-2025-55182. That probe does not execute operating-system commands.
• A TLS handshake to read certificate dates
• Pro modules (subscribers only): cookie flags, CORS, CSP quality, mixed content, leftover backups, JS library versions, CMS markers, SPF/DMARC, and a conservative Next.js middleware-header check on the homepage only

What we never do

• Remote code execution or shell commands on the target
• Dumping environment variables, passwd files, or SSH keys
• Emailing webmasters you did not explicitly choose
• Scanning private networks, localhost, or non-80/443 ports

User-Agent

Requests identify us as SafetyScan/1.0 (+/about) so operators can see who connected.

React2Shell

CVE-2025-55182 is a critical RCE in React Server Components. Patched Next.js releases include 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7 (or later in those lines). If SafetyScan reports vulnerable, upgrade immediately and rotate secrets if the app was public while unpatched.

Free vs Pro

Free accounts get one preview per week. Preview evidence is the basic scan only. Pro runs the extra modules and unlocks leftover paths, cookie names, library versions, and DNS. Unlocking a report makes that shareable URL fully visible so you can send it to a webmaster. Switching VPN or IP does not grant extra free scans.