# BoringSec

> BoringSec is an evidence-backed website Security Audit for AI-built apps. A bounded public scan checks the deployed URL with 17 pre-verification modules and exposes the maximum available findings, evidence, and coverage state. After domain verification, exactly 6 heavy scanners can run for the owner. 3 of them are external engines. Findings distinguish confirmed evidence, partial coverage, unavailable checks, and authorization-required checks so an untested surface is never presented as clean.

Key facts:
- The public product is Security Audit. SEO Audit remains hidden from public acquisition and navigation.
- A free bounded scan starts from a URL without signup.
- The 6 verified-owner heavy scanners are exactly Injection, XSS, Ports, Nuclei, OWASP ZAP, and Medusa. Nuclei, ZAP, and Medusa are the 3 external engines. Repository context and other privileged checks keep their own authorization requirements.
- Anonymous or crawler scans never authorize deep scanning, publication, or outreach.
- Pre-verification reports expose available findings and coverage but never promise a final Security Score. Reports use an A++ to F grade only after the required owner-authorized coverage settles and the evidence supports assessment. Incomplete results stay explicitly unavailable or provisional.
- BoringSec is an automated external assessment, not a penetration test, certification, or guarantee of security.
- Scanner implementation, detection rules, scoring implementation, and internal test corpus are proprietary.

## Product

- [Run a free Security Audit](https://www.boringsec.com/en): Start a bounded scan of a deployed website.
- [How it works](https://www.boringsec.com/en/how-it-works): Scan stages, evidence states, scoring, and authorization boundaries.
- [Security for AI-built apps](https://www.boringsec.com/en/vibe): Risks common to apps built with Cursor, Lovable, Bolt, v0, Replit, Windsurf, and Claude Code.
- [Methodology](https://www.boringsec.com/en/methodology): Scope, evidence standards, limitations, and scanner availability.
- [Sample report](https://www.boringsec.com/en/sample-report): A representative report with findings, fixes, and coverage semantics.
- [Pricing](https://www.boringsec.com/en/pricing): Current plans and report access.
- [Trust center](https://www.boringsec.com/en/trust): Data handling, retention, subprocessors, and responsible scanning.
- [Responsible disclosure](https://www.boringsec.com/security): How to report a security issue in BoringSec.
- [Security badge](https://www.boringsec.com/en/badge): Embeddable evidence status for an eligible verified domain.
- [Plugins and installation](https://www.boringsec.com/en/plugins): Official WordPress and MCP downloads, requirements, checksums, and release status.
- [Compare](https://www.boringsec.com/en/compare): Compare only eligible, fresh, explicitly publishable domain evidence.

## Documentation

- [Documentation](https://www.boringsec.com/en/docs): Product and integration overview.
- [Quickstart](https://www.boringsec.com/en/docs/quickstart): From first scan to a verified fix.
- [Understanding reports](https://www.boringsec.com/en/docs/reports): Grades, severity, evidence, coverage, fixes, and retests.
- [Scanner reference](https://www.boringsec.com/en/docs/scanners): Public scanner capability and evidence contracts.
- [Security Score](https://www.boringsec.com/en/docs/security-score): Weights, caps, score-withholding, and coverage rules.
- [Domain verification](https://www.boringsec.com/en/docs/domains): Why privileged checks require verified ownership.
- [REST API](https://www.boringsec.com/en/docs/api): Authenticated programmatic scanning and reports.
- [MCP](https://www.boringsec.com/en/docs/mcp): Use the hosted BoringSec security workflow from compatible AI tools.
- [Monitoring](https://www.boringsec.com/en/docs/monitoring): Recurring checks and alerts for verified domains.

## Security guides

- [Security guides](https://www.boringsec.com/en/blog): Practical website security guidance.
- [AI app launch checklist](https://www.boringsec.com/en/blog/website-security-checklist-ai-apps)
- [Supabase RLS and service-role keys](https://www.boringsec.com/en/blog/supabase-security-rls-service-role)
- [Exposed API keys in JavaScript](https://www.boringsec.com/en/blog/api-keys-leaked-javascript-bundle)
- [Security headers](https://www.boringsec.com/en/blog/security-headers-guide)
- [TLS mistakes](https://www.boringsec.com/en/blog/ssl-tls-mistakes)
- [Cookie security](https://www.boringsec.com/en/blog/cookie-security-flags)
- [SPF, DKIM, and DMARC](https://www.boringsec.com/en/blog/spf-dkim-dmarc-email-spoofing)
- [Subdomain takeover](https://www.boringsec.com/en/blog/subdomain-takeover)
- [CORS misconfiguration](https://www.boringsec.com/en/blog/cors-misconfiguration)