ShieldLens: Website Security Scanner

Website security scanner in your side panel. Private by design: OWASP findings, vulnerable libraries, fixes for your stack.

ShieldLens checks the security of the website you're on, right in Chrome's side panel. It explains every issue it finds in plain language and shows you how to fix it. There is no account and no server: everything runs on your device, and nothing from the page is ever uploaded. WHAT IT DOES • Gives the site a security grade using Mozilla's published HTTP Observatory method, and a risk level based on the most serious issue found • Runs 116 checks covering security headers, cookies, scripts, forms, storage and privacy, and rates each finding with the industry-standard CVSS scoring system • Finds JavaScript libraries with known vulnerabilities and flags the ones attackers are actively exploiting • Spots secrets left in page code (always shown masked), card-skimming scripts and browser fingerprinting • Gives copy-paste fixes tailored to the server and framework the site runs on • Shows which OWASP Top 10 and other security-standard requirements pass or fail • Works on pages behind your login, and can record a journey from sign-in to sign-out to check how sessions are handled • Watches payment pages for unexpected script changes, daily or weekly • Exports a designed HTML or PDF report with charts and an executive summary, plus data files for developer tools • Optional on-device AI explains any finding and answers your follow-up questions, using Chrome's built-in model FOR SITE OWNERS After you prove you own a site, ShieldLens can run a few extra read-only checks, such as looking for configuration files that were published by mistake. PRIVATE BY DESIGN • Nothing from the pages you scan is uploaded. Their content, code, cookies, form data and your results stay on your device. • No accounts, no analytics, no tracking. • ShieldLens only downloads: from the site you're scanning, and the public script files that page loaded, so they can be checked for known vulnerabilities (you can turn this off). • Optional domain and certificate checks are off by default. When turned on, they send only domain names to Cloudflare's public DNS resolver and to crt.sh, a public certificate search. • Every request ShieldLens makes is listed in Settings. • Site access is requested one site at a time, only when you scan. LIMITATIONS ShieldLens is a passive scanner, not a penetration testing tool. It can't test server-side flaws such as SQL injection, and a good grade isn't proof that a site has no vulnerabilities.