What it checks
Public API body and headers for debug signatures, secret-looking values, cache-control gaps, CORS behavior, content type, and framework disclosure.
Free Techclick tool
Find API response leaks before users and attackers see them.
Scan a public unauthenticated API URL for verbose errors, stack traces, debug flags, secret-looking fields, weak cache controls, permissive CORS, and framework disclosure. Evidence is capped and redacted.
Leak score
-
0/100
No scan yet.
0 pass
0 warn
0 fail
Findings
Remediation
Redacted Evidence Sample
Safety limits
No credentials, no private networks, no crawling, no exploit payloads, no login testing, and no full response dumps.
Learning path
Use with Headers, Recon, JWT, CVSS, and Mail Header Analyzer to build a practical API security review workflow.