SaaS Security Scanner Chrome extension security report

SaaS Security Scanner tells you what is actually wrong with the website in front of you — and explains each finding in language you can act on, rather than a wall of raw numbers. Open the side panel on any page and you get four scored areas: SECURITY Missing Content-Security-Policy, HSTS and clickjacking protection. Cookies without Secure or HttpOnly. Session tokens sitting in localStorage where any script can read them. Mixed content, unsandboxed frames, third-party scripts without integrity hashes. SPEED Not just how slow, but why: server response time, render-blocking scripts and stylesheets, oversized images, text served without compression, expensive third-party origins, main-thread freezes, and which element is the largest one your visitors wait for. SEO Title and description lengths with a live search-result preview, H1 and heading structure, canonical URLs, Open Graph tags, structured data, mobile viewport, image alt text, and indexability — including a stray "noindex" that would quietly remove the page from search. STACK The backend language, framework, CMS, web server, CDN and analytics the site uses — each with the exact evidence behind the guess, because fingerprinting is inference, not proof. WHOLE-SITE SCAN One page cannot show you duplicate titles, a missing canonical on one template, a broken link, or a security header that is applied to some routes and not others. Press "Scan the rest of the site" and it samples pages from across the domain — spread over sections, not just the first few — and reports what only shows up in comparison. BUILT TO BE TRUSTED - Every analysis runs inside your browser. - No account, no sign-in, no analytics, no telemetry. - Nothing is sent to the developer or to any third party. - Read-only: pages are never modified. - Every finding shows the evidence it is based on, so you can judge it yourself. Available in 20 languages. WHAT IT IS NOT It reads what a browser can see. Tenant isolation, access control and business logic flaws need a server-side review — this catches the outer surface, which is a real but bounded slice of the problem, and the panel says so plainly.