Question 1

What is SimplyScan?

Accepted Answer

SimplyScan is a site health scanner purpose-built for apps created with AI and no-code tools. One scan grades your app across 8 dimensions · security, speed, SEO, AI visibility, accessibility, GDPR compliance, domain health, and email security · then gives you a report with per-dimension scores, fix recommendations, code examples, and AI fix prompts. Beyond one-off scans, the Pro Monitoring subscription adds continuous protection · uptime monitoring with public status pages, Slack, GitHub & Linear integrations, and 2 Pro scan credits every month. There are also 60 free standalone developer tools and an MCP server for AI editors.

SimplyScan is built and maintained by Kraftwire Software, a US and UK software company headed by Daniel Agoston · a former Metropolitan Police officer and London Fire Brigade firefighter who retrained in computer science and became a software engineer.

Question 2

How much time does this actually save?

Accepted Answer

Based on our data · a manual security audit of 51 checks across 14 categories takes a security consultant 8-12 hours (at $150-300/hr, that's $1,200-3,600). SimplyScan completes the same audit in under 30 seconds · and grades SEO, AI visibility, accessibility, GDPR, domain and email health in the same pass. Run monthly scans and you're saving 96-144 hours per year. The AI does the heavy lifting · you just review 10-40 pre-qualified findings and apply the fix prompts.

Question 3

Which platforms does SimplyScan support?

Accepted Answer

SimplyScan works with any publicly accessible web app. It's optimized for tools like Lovable, Replit, Bolt.new, Cursor, Windsurf, v0, Base44, Raydian, Bubble, WeWeb, Xano, and FlutterFlow. It also supports apps built with React, Next.js, Vue, Express, Django, Flask, FastAPI, and backends powered by Supabase, Firebase, MongoDB, and PostgreSQL.

Question 4

What does the free scan include?

Accepted Answer

The free scan analyzes 4 security and speed categories: Secrets (leaked API keys and credentials), Frontend (exposed environment variables in client-side bundles), Supabase (missing or weak Row Level Security policies), and Speed (performance bottlenecks with 1 free fix included). You also get your site health scores across SEO, AI visibility, accessibility, GDPR, domain, and email · the detailed findings behind those scores are part of the Pro report. No sign-up or credit card is required.

Question 5

What does the full scan cover?

Accepted Answer

The full scan grades all 8 dimensions. Security and speed cover 14 categories: secrets, auth, injection, XSS, unprotected endpoints, CSRF & security headers, configuration errors, architecture risks, performance blockers, exposed frontend variables, Supabase RLS, vibe-code patterns, AI-specific security risks like prompt injection, and speed optimization. On top of that you get full findings for SEO (50+ checks), AI visibility (40+ checks across 9 answer engines), accessibility (WCAG 2.2), GDPR compliance, domain health (expiry, DNSSEC, registrar lock), and email security (SPF, DKIM, DMARC). Pro users can also connect a public GitHub repository to scan backend source code, server configurations, and files that aren't visible in the deployed frontend.

Question 6

Can I rescan after fixing issues?

Accepted Answer

Yes. Every Pro Report includes two free rescans within 14 days of purchase. To use your free rescans, you must be signed in to the account that made the purchase · this allows us to verify ownership and correctly attribute the rescans. After your initial scan, fix the issues found, then hit the Free Rescan button on your scan results page or dashboard to verify your fixes · no additional payment required.

Question 7

Are SimplyScan results consistent between scans?

Accepted Answer

Yes. Your security and speed scores come from the SimplyScan Engine · our proprietary deterministic analysis layer · not from an AI's shifting opinion. The engine detects issues with fixed rules and calculates your score with fixed weights, so the same site produces the same score every time, and a rescan only moves the number by what you actually changed. AI still writes the plain-English explanations and fix prompts and surfaces the deeper semantic issues that rules can't catch · but it is never allowed to move your score. That is why our trust badge and Pro Monitoring alerts are dependable. We keep the exact rules and weights private, but you can read the full approach in How the SimplyScan Engine Delivers Consistent Results.

Question 8

What is Pro Monitoring?

Accepted Answer

Pro Monitoring is SimplyScan's subscription plan · $24/month, or $240/year with 2 months free. It includes 2 Pro scan credits every month (each worth a full 8-dimension report), uptime monitoring with public status pages, Slack, GitHub & Linear integrations, and priority support. You can cancel anytime via Manage subscription in your dashboard · your plan then runs until the end of the period you've paid for.

Question 9

How long does a scan take?

Accepted Answer

Most scans complete in under 30 seconds. SimplyScan fetches your app's deployed code and runs AI-driven analysis across all selected categories in real time.

Question 10

Why do AI-built apps need a security scanner?

Accepted Answer

AI coding tools generate functional code fast, but they routinely skip security best practices · hardcoding API keys, shipping .env values to production, leaving database tables without access controls, and creating endpoints without authentication middleware. They also write slow code: redundant API calls, heavy bundles, and missing optimizations. SimplyScan catches what AI misses before attackers find it. For independent verification, see SusVibes Research (arXiv), Tenzai Research, Escape Security's vibe-coding methodology, and the CVE-2025-48757 statement.

Question 11

Is my source code stored or shared?

Accepted Answer

No. SimplyScan analyzes the publicly served output of your application (HTML, JavaScript, configuration) · the same content any visitor can already see. We do not access your source repository, and we never sell your data or share it with third parties for their own use. Scan content is processed by our infrastructure and AI analysis providers strictly to produce your report · see our Privacy Policy for the full list. If you choose to connect a GitHub repo for a Pro scan, we fetch and analyze your source files during the scan but do not store them permanently.

Question 12

How does SimplyScan protect my data?

Accepted Answer

SimplyScan is built on infrastructure that is SOC 2 Type 2 and ISO/IEC 27001:2022 certified, and GDPR compliant. These certifications are held by our infrastructure providers · not by Kraftwire Software directly. All data is encrypted with AES-256 at rest and TLS 1.3 in transit. We enforce row-level security so users can only access their own scan results. Our infrastructure providers undergo continuous independent security auditing to maintain their certifications. For GitHub repo scans, your source code is processed in memory and never stored permanently. We maintain a zero data breach record since launch. For a plain-English walkthrough of what these standards actually do, read our guide: AES-256 & TLS 1.3 explained.

Question 13

Is SimplyScan built on SOC 2 compliant processes?

Accepted Answer

SimplyScan is built on SOC 2 Type 2 compliant processes infrastructure, the same compliance standard used by enterprise security tools. This means our infrastructure providers have been independently audited for security, availability, processing integrity, confidentiality, and privacy controls. Combined with ISO 27001:2022 certification held by the same providers, the infrastructure we use meets the highest industry standards for data protection. To be clear: these certifications are held by our infrastructure providers · Kraftwire Software does not independently hold SOC 2 or ISO 27001 certification. We select, monitor, and build exclusively on providers that maintain these standards.

Question 14

What encryption protects my data on SimplyScan?

Accepted Answer

Your data is protected by AES-256 encryption at rest and TLS 1.3 in transit · both provided by our infrastructure. AES-256 is the same encryption standard used by governments and financial institutions worldwide. TLS 1.3 ensures that every connection between your browser and our servers is protected against eavesdropping and tampering. AES-256 is standardized by NIST in FIPS 197 and TLS 1.3 is defined in RFC 8446. For a plain-English walkthrough, read our guide: AES-256 & TLS 1.3 explained.

Question 15

Can I scan apps that aren't built with AI tools?

Accepted Answer

Absolutely. While SimplyScan is optimized for AI and no-code platforms, it works on any web application. The scanner analyzes deployed output regardless of how the code was written.

Question 16

Does SimplyScan have access to my database?

Accepted Answer

No. SimplyScan never connects to your database directly. We analyze your application's publicly accessible frontend code, API responses, and configuration · exactly what any visitor to your site can already see. For Pro scans with GitHub repo access, we read source files during the scan session only and never store them.

Question 17

Why should I trust SimplyScan with my GitHub repo?

Accepted Answer

SimplyScan only reads public GitHub repositories · the same code anyone can already view on GitHub. We never request write access, GitHub OAuth tokens, or any repository permissions. During a Pro scan, your source files are fetched, analyzed in memory, and immediately discarded. No source code is stored permanently on our servers. SimplyScan has zero access to your database, hosting environment, deployment pipeline, or any private credentials. The scan runs on SOC 2 Type 2 compliant infrastructure with AES-256 encryption at rest and TLS 1.3 in transit (Independent from Kraftwire Software). We cannot modify your code, push commits, or make any changes to your repository · we can only read what's already publicly visible.

Question 18

What does the speed optimization scan check?

Accepted Answer

The speed scan covers 10 checks: redundant network requests (e.g., duplicate auth calls doubling your API traffic), blocking loading states (spinners that delay content), missing code splitting (your entire app loaded on every page), heavy bundle dependencies (45KB+ libraries for simple animations), missing query cache optimization (re-fetching data on every navigation), theme/style flash on load, missing image preloading (slow hero images), missing lazy loading for below-the-fold images, render-blocking CSS or JavaScript, and unoptimized third-party script loading. Each finding shows the exact issue, its impact on load time, and a fix with code examples (Pro).

Question 19

How much does site speed actually affect my business?

Accepted Answer

Industry research shows a 100-millisecond delay cuts conversions by 7% (Akamai, State of Online Retail Performance) · a 1-second delay means 11% fewer page views and a 16% drop in customer satisfaction (Aberdeen Group) · sites loading in 1 second convert up to 2.5x more than sites loading in 5 seconds (Portent) · and 53% of mobile users abandon pages that take over 3 seconds (Google). Speed is not a technical detail · it directly affects your revenue, retention, and user trust.

Question 20

Is the platform comparison on this site accurate?

Accepted Answer

The platform comparison section is based on the latest publicly available information as of March 2026 and is provided for informational purposes only. Platform features may have changed since this information was gathered. SimplyScan is not affiliated with any of the platforms listed. If you believe any information is outdated or inaccurate, please contact us at simplyscan@kraftwire.com. See our Terms of Service for details.

Question 21

What happens if the target website is down or returns an error during a Pro scan?

Accepted Answer

If a technical issue prevents us from scanning the target URL · for example, the site is under maintenance, temporarily offline, or returns a server error · your Pro credit is automatically restored so you can scan again at no extra cost. No action needed on your part. However, please note that typos in the URL (e.g. typing gogle.com instead of google.com) are considered user input and are not covered by this policy, so please double-check your URL before scanning.

Question 22

Does SimplyScan offer free standalone tools?

Accepted Answer

Yes. Alongside the main scan, SimplyScan has 60 free, no-signup tools in six groups. Live site checks: SSL/TLS certificate, security headers, DNS security and DNS lookup, CORS, email security (SPF, DKIM, DMARC), exposed files, and security.txt. Security analyzers (nothing is uploaded): secret scanner, .env file linter, JWT debugger, CSP evaluator, password strength, email header analyzer, punycode/homograph checker, robots.txt tester, and user-agent parser. Generators: passwords, UUIDs, API keys, JWTs, HMAC, PKCE, Basic Auth headers, CSP policies, hashes, SRI, AES encryption, TOTP codes, .gitignore files, and data URIs. Converters and formatters: JSON, JSON to TypeScript, CSV, Base64, URL encoding, HTML entities, timestamps, case, number bases, curl to fetch, Markdown, XML, text diff, slugs, and colors. Testers and references: regex, cron, semver, URL parser, subnet and chmod calculators, WCAG color contrast, MIME types, HTTP status codes, and ports. Visibility: an SEO checker, an AI Visibility (AEO) checker, a meta tags generator, and a UTM builder. Each gives an instant result · browse them all under Free Tools in the nav, or at /tools.

Question 23

What is the AI Visibility (AEO) checker?

Accepted Answer

AEO stands for Answer Engine Optimization. The AI Visibility checker reads your robots.txt and reports, per engine, whether AI answer engines · ChatGPT/GPTBot, Claude/ClaudeBot, PerplexityBot, Google-Extended and others · can crawl and cite your site. It also checks your llms.txt, structured data, and whether your content is server-rendered, so you can make sure your app shows up when people ask an AI assistant for recommendations.

Question 24

Can SimplyScan monitor my app's uptime?

Accepted Answer

Yes, with a Pro Monitoring subscription ($24/month or $240/year). Add any app as an uptime monitor and SimplyScan pings it every few minutes, tracks response time and 24h/7d/30d uptime, and hosts a shareable public status page for each app (e.g. simplyscan.io/status/your-app). Manage your monitors from the Uptime tab in your dashboard.

Question 25

Can I send scan findings to Slack, GitHub, or Linear?

Accepted Answer

Yes, with a Pro Monitoring subscription. Connect a Slack incoming webhook, a GitHub repository, or Linear from the Integrations tab in your dashboard, then push any completed scan's findings straight to your team · as a Slack message, a GitHub issue, or a Linear issue. Your tokens are stored write-only and are never sent back to your browser.

Question 26

Does SimplyScan have an MCP server?

Accepted Answer

Yes. SimplyScan runs a Model Context Protocol (MCP) server so you can plug it directly into AI coding assistants like Claude, Cursor, and Windsurf. Once connected, your AI agent can run a full scan or any of the individual checks (security headers, AI visibility, SEO, SSL, email security, exposed files) without leaving your editor.

Question 27

Who is Kraftwire Software?

Accepted Answer

Kraftwire Software is the small, independent US and UK software studio behind SimplyScan, focused on building fast, privacy-first tools for people who value simplicity over feature bloat.

It's headed by Daniel Agoston · a former Metropolitan Police officer and London Fire Brigade firefighter who retrained in computer science and became a software engineer. He spent his first career protecting people · SimplyScan applies that instinct to the web.

Your vibe-coded app might be leaking customer dataexposing your usersone query from a breachan open databasehanding out API keyswide openleaking customer data

Your vibe-coded app might be leaking customer data