IOnclad
Pre-Launch Audit · Free + Pro

Am I safe
to ship?

Pre-launch security scanner that runs 100% offline — source code never leaves your machine. 24 scanners and 800+ checks across hardcoded secrets, AI-generated code patterns (the Vibe Code Pack), OWASP Top 10, infrastructure-as-code, and git history — plus a Pro Live Site Auditor that checks your deployed site. Browser tier free forever; Pro desktop ($49) unlocks every finding. Built by The IOn Project.

Try the Browser Scanner → Download for Windows
100% offline · nothing leaves your machine · no signup, no tracking
What It Catches

Twenty-four scanners.
One verdict.

Every scan runs the full catalogue across your code, configs, and commit history. The output is always one of two things, Ship It or Not Ready.

→

Secrets Everywhere

AWS keys, Stripe tokens, GitHub PATs, OpenAI keys, JWT secrets, PEM blocks, database URLs with embedded creds. 50+ provider patterns plus entropy detection for unknown formats.

How it works

Scans source, configs, comments, and committed .env files. Each hit comes with its exact file and line, a provider classification, and a live-shaped vs. placeholder judgment, so you rotate the keys that actually matter and skip the decoys.

Read the full risk breakdown →
→

Vibe Code Pack

The AI-generated vulnerability patterns that ship most often. // TODO: add auth, hardcoded passwords masquerading as placeholders, console.log of sensitive data, auth checks without await.

How it works

Tuned to how Claude, Cursor, and Copilot fail: auth left as a TODO, mock data shipped to prod, permission checks missing an await, and "temporary" hardcoded credentials that quietly became permanent.

Read the full risk breakdown →
→

Git History Scanner

Every commit. Every stash. Catches secrets that were committed once, then "removed", but they're still there in the history forever, accessible to anyone with clone access.

How it works

Walks every commit, branch, and stash, not just the working tree. A secret you deleted in a later commit is still recoverable by anyone with clone access; IOnclad surfaces it with the SHA and date it first appeared.

Read the full risk breakdown →
→

OWASP Top 10 (AST)

Tree-sitter structural analysis across 7 languages, JS, TS, Python, Java, Go, Ruby, PHP. SQL injection, command injection, XSS, SSRF, deserialization, broken access control, and check-then-act race conditions (TOCTOU).

How it works

Parses code into a syntax tree instead of grepping strings, so it follows tainted input from request to sink. The result is real data-flow analysis with far fewer false positives than regex scanners, across all 7 languages.

Read the full risk breakdown →
→

Framework Safety

Express, Next.js, Django, Flask, Rails, Laravel, React, Vue. Catches DEBUG=True in prod, NEXT_PUBLIC_ secrets, missing CSRF, dangerouslySetInnerHTML with user data, the classics.

How it works

Knows each framework's specific footguns, Django DEBUG, Next.js NEXT_PUBLIC_ leakage, missing Express CSRF, React dangerouslySetInnerHTML on user input, and maps every finding back to the framework's own security guidance.

Read the full risk breakdown →
→

IaC + Deploy

Dockerfile, docker-compose, Terraform, GitHub Actions, Nginx. Plus 30+ deploy-readiness checks, TLS enforcement, DB SSL, K8s probes, healthcheck endpoints, env-var hygiene.

How it works

Reads your Dockerfiles, Terraform, and CI workflows for misconfiguration, root containers, public buckets, secrets baked into build args, then runs a 30+ point deploy-readiness checklist before anything reaches production.

Read the full risk breakdown →
→

API Surface Mapper

Auto-discovers every route in your codebase. Per-route check for auth middleware, input validation, rate limiting, CORS posture, and error handling. Find the unprotected admin route before someone else does.

How it works

Builds a live inventory of every route, then audits each one for auth, validation, rate limits, and CORS. The output is a per-endpoint matrix that makes the single unprotected admin route impossible to overlook.

Read the full risk breakdown →
→

iOS / PWA / GraphQL

ATS, keychain, UIWebView, SSL pinning. Service worker scope and cache poisoning. GraphQL introspection, depth limits, resolver auth. Plus email security and accessibility.

How it works

Covers the mobile and edge surfaces most scanners skip: App Transport Security, keychain misuse, SSL pinning, service-worker cache scope, and GraphQL introspection or unbounded query depth.

Read the full risk breakdown →
→

Privacy + Compliance

GDPR, CCPA, App Store ATT, Google Play Data Safety. PII-in-logs detection. Catches what your legal team will catch later, except now you have time to fix it.

How it works

Maps your data handling against GDPR, CCPA, ATT, and Play Data Safety. It flags PII written to logs or analytics and the documentation gaps a compliance review would catch, while you still have time to close them.

Read the full risk breakdown →
→

Live Site Auditor PRO

Audits your deployed site, fetched from your own machine and reconciled against source. Secrets baked into the JS bundle, security headers stripped at the CDN, vulnerable libraries (retire.js), SPF/DMARC/DKIM, and real-user Core Web Vitals. Dual verdict: secure to ship, and found by Google.

How it works

Fetches your deployed site from your own machine and diffs it against source. Catches secrets that survived the bundler, headers stripped at the CDN, outdated libraries, and DNS/email-auth gaps Google can see.

Read the full risk breakdown →
→

LaunchGuard

The non-code risks that still sink a launch, modeled as adversaries: Your Lawyer (missing ToS / privacy policy / liability cap), The Auditor, Google. Evidence-cited and advisory, sharpened by a few disclosure questions, never a substitute for counsel.

How it works

Models the people who can stop your launch as adversaries, Your Lawyer, The Auditor, Google, and checks for the artifacts each one expects. Evidence-cited and advisory, never a substitute for counsel.

Read the full risk breakdown →
→

CostGuard™, Denial-of-Wallet

The bugs that don't breach you, they bankrupt you. Runaway render loops, missing idempotency on paid actions, retry storms, unbounded fan-out, and serverless recursion that can turn a quiet night into a five-figure cloud bill.

How it works

Finds the patterns that become surprise cloud bills: render loops, retry storms, unbounded fan-out, missing idempotency on paid endpoints, and recursive serverless invocations, each ranked by blast radius.

Read the full risk breakdown →
→

AI Co-Pilot (MCP) PRO

Wire IOnclad into the AI assistant you already use, Claude, Cursor, and other MCP clients, so it scans code as it's written, before it hits disk. Secrets are redacted at the boundary. Opt-in, off by default.

How it works

Connects over the Model Context Protocol so your assistant scans code the moment it's generated, before it ever touches disk. Secrets are redacted at the boundary; it's opt-in and off by default.

Read the full risk breakdown →
→

Projects, Weakest-Link Verdict PRO

A real product is more than one repo. Group your web app, API, and marketing site into a Project and get one aggregate verdict, the weakest surface gates the whole launch, exactly like real life.

How it works

Aggregates multiple repos into one product verdict where the weakest surface gates the whole launch, so a hardened API can't paper over a leaky marketing site, exactly the way a real attacker picks the softest target.

Read the full risk breakdown →
→

CASA / ASVS Readiness PRO

Turns a scan into the shape a Google CASA assessment reads: every finding tagged with its CWE id and grouped by the OWASP ASVS v4.0 control area it maps to, exportable as a Markdown report.

How it works

A readiness aid, not a certification. Google deprecated the CASA self-scan, so the honest role of any static tool is exactly this: find and fix the mapped issues before the authorized lab assessment. IOnclad is not an authorized assessor, and a clean scan is not a pass. The report itself says so.

Read the full risk breakdown →
→

Binary Inspector

Point it at any compiled artifact, .exe, .dll, .so or .dylib, and read what actually ships: which exploit mitigations are compiled in, embedded secrets and strings, imported functions, and whether the file is packed.

How it works

Most scanners stop at source. The Binary Inspector reads the built executable itself, useful when you inherited a build, vendored a dependency, or want to know what a release really contains. Optionally check any file's hash against 70+ engines with your own free VirusTotal key.

Read the full risk breakdown →
→

SBIR / STTR Cyber Precheck FREE

A free self-assessment dry-run for the cyber questions on an SBIR/STTR application. It checks a couple of controls locally and gives you an honest worklist of what is still open.

How it works

A practice worksheet, not a submission. It never produces a score, a grade, or a "you will pass", and it is not affiliated with or endorsed by the Department of Energy or any agency. You stay responsible for your own answers. This just helps you prepare.

Read the full risk breakdown →
→

Mobile Readiness

Will it look right on a phone? Catches the source patterns that break mobile layout: a missing viewport meta, images that stretch, fixed-width containers that overflow, zoom disabled, and stylesheets with no responsive breakpoints.

How it works

The offline, pre-deploy complement to the Live Site Auditor: it flags the patterns in your source before you ship, while the Live Auditor measures the real result on your deployed URL. Quality signals that sharpen your grade, never gate the security verdict.

Read the full risk breakdown →
→

Frontend Performance

Will it load fast? Flags render-blocking head scripts and CSS @imports, images with no reserved space (layout shift), missing font-display, full-library imports that bloat the bundle, and array-index React keys.

How it works

Static checks for the patterns that slow a page or make it jank, before deploy. The real Core Web Vitals come from the Pro Live Site Auditor; this is the free, offline early warning. Advisory quality signals, never a gate on the ship verdict.

Read the full risk breakdown →
What Pro unlocks
Every scanner above runs in the free verdict, with your grade and top finding. Pro ($49) unblurs every finding across all 24, and adds the Live Site Auditor, the AI Co-Pilot, multi-surface Projects, the CASA / ASVS readiness report, unlimited history, scan-to-scan diff, suppressions, and PDF / SARIF / JSON export. One upgrade, the whole depth.
How It Works

Pick. Scan. Ship.

01

Pick Your Project

Browser scanner: drop a folder or zip. Desktop: pick any directory on disk. Nothing uploads. Your code never crosses to a server, verifiable in DevTools.

02

Scan Locally

Browser tier scans 109 patterns in under a minute. Desktop runs all 24 scanners and 800+ checks against 10k files in seconds, Rayon parallel, Rust-powered.

03

Get the Verdict

A–F grade, severity counts, and one of two binary verdicts: SHIP IT or NOT READY. Top 3 priorities surfaced first. Fix list ranked by severity divided by effort.

See It In Action

The actual app.
No hand-waving.

A native desktop app, fast, offline, built for the moment before you ship. Every scan ends with one binary verdict: Ship It, or Not Ready. Here's what you actually see.

Verdict
IOnclad Audit results: a NOT READY verdict, F grade at 26 of 100, 22 critical findings, per-scanner result bars, and the Top 3 to fix before launch
Scanners
IOnclad Audit setup: the always-on scanner catalogue with per-scanner check counts, plus Full and Quick scan modes
Audit
One binary verdict, Ship It or Not Ready, gated on zero critical findings. Every issue ranked by what to fix first, with the exact file and line. Plus LaunchGuard's launch-liability check (advisory, not legal advice).
IOnclad Projects view: a product's weakest-link aggregate verdict across its web app, API, and marketing site, with the launch adversaries The Breach, Your Lawyer, Your Bill, and Google
Projects
One product, many surfaces. The verdict is the weakest link across your web app, API, and marketing site, scored against the adversaries that actually gate a launch: The Breach, Your Lawyer, Your Bill, Google.
IOnclad Live Site Auditor: choose a project folder and enter a deployed URL to run a hybrid source-plus-live audit
Live Site Auditor · Pro
Audits your deployed site too, fetched natively from your own machine, then reconciled against your source. Catches secrets shipped in the JS bundle, security headers stripped at the CDN, vulnerable libraries, DNS gaps, and what Google sees.
Pricing

The verdict is free.
The depth is paid.

Grade, verdict, and your top finding, always free, no trial caps. Pro unlocks every finding, Fix This First, scan diff, and full history.

Free
$0
forever
browser + desktop
  • Verdict + A–F Grade
  • Severity counts
  • Top 1 finding in detail
  • 17 standalone tools
  • README badge
  • Last 5 scans
Try free scanner →
Popular
Pro
$49
/yr
or $149 lifetime
  • All findings, unblurred
  • Live Site Auditor (deployed site)
  • AI Co-Pilot via MCP
  • Multi-surface Projects
  • Fix This First queue
  • Pre + Post-Launch modes
  • PDF + JSON export
  • Unlimited scan history
  • Scan-to-scan diff
  • Suppressions
Buy Pro →
Team
$199
/yr (5 seats)
or $499 lifetime
  • Everything in Pro
  • 5 seats included
  • Shared suppressions (Git)
  • Branded PDFs
  • Priority support
Buy Team →
Business
$2,499
/yr (25 seats)
subscription only
  • Everything in Team
  • SSO (SAML / OIDC)
  • Audit logs
  • Compliance mapping
  • SBOM generation
  • CLI / SARIF
Buy Business →

Enterprise: from $10,000/yr custom

Regulated industries, custom contracts, dedicated support, custom rule authoring, unlimited seats. Subscription only.

Contact Sales
Use Cases

Built for people
who actually ship.

Vibe Coders

You shipped fast with AI help. Now you want to know what slipped through. The Vibe Code Pack catches the patterns Cursor, Copilot, and Claude generate when they're guessing, TODO-auth, fake placeholders, missing awaits.

Indie Devs & Solo Founders

No security team to bug. No budget for SOC2-grade tooling. You need a fast, honest "ship or not" answer the day before launch, and a fix list ranked by severity-divided-by-effort so you spend your last 24 hours on what actually matters.

Small Dev Teams

Five seats, shared suppressions committed in Git, branded PDFs for the post-mortem. Run it as the last step of your release checklist. Run it again post-launch as a regression gate.

Mid-Market & Regulated

SSO, audit logs, SOC2 / ISO 27001 / HIPAA mapping, SBOM generation, SARIF for GitHub Security. Business and Enterprise tiers. Self-hosted everything; nothing leaves your infra.

Why IOnclad

The honest scanner.

Most security tools either upload your code, hide their disclaimer in fine print, or do both. IOnclad inverts that.

✓

100% Offline. Verifiable.

Open DevTools → Network → run a scan → confirm zero requests. Your code never reaches our servers because we don't have servers. Browser scanner is static HTML+JS on Cloudflare; desktop is Tauri+Rust on disk.

✓

Disclaimer in the Open

Every scan results page shows the same disclaimer about scope: we cover known patterns and common misconfigurations, not a comprehensive pen test. No fine print. The honest framing is the brand position.

✓

Free Verdict, Paid Depth

The grade and verdict are always free, no trial caps, no email walls. You pay for the workflow depth, full findings, Fix This First, history, diff. Conversion happens because you want depth, not because you can't see basics.

✓

Built for Pre-Launch, Not Post-Mortem

Most security tools assume you've already shipped and are firefighting. IOnclad runs at the moment when fixing is cheapest, before launch. Plus a Post-Launch mode that escalates secret-leakage severity (because once committed, it's worse).

✓

Git History Coverage

Most scanners look at HEAD. Real attackers look at git log -p --all. We walk every commit and every stash with libgit2, then run the same secret patterns against the diffs.

✓

Air-Gap Friendly

Ed25519 offline license validation. No phone-home. The auto-updater is opt-out. When disabled, the desktop app makes zero network calls, ever. Compliance teams can verify in the app's privacy page.

Scope of this scanner

These checks cover known vulnerability patterns and common misconfigurations. They do not constitute a comprehensive penetration test, security certification, or guarantee against all possible attack vectors. Users remain responsible for their own security posture, including secure coding practices, ongoing monitoring, and professional security review where appropriate.

Stop guessing.
Start shipping.

Your code never leaves your machine. Free verdict, no signup, no email wall.

Try the Browser Scanner → Download for Windows

WINDOWS · MACOS & LINUX COMING SOON

By purchasing or using IOnclad you agree to our Terms, EULA & Privacy Policy. Sold by Polar (merchant of record). 14-day refund policy.