Free tools

Check where a path would lead

Supply a base directory and candidate paths. See lexical escapes and platform-specific risks before reviewing your filesystem checks.

In your browser nothing you paste is uploaded
Up to 1 MiB

Choose a path format, set the allowed base directory, and list the paths to test.

Loading this tool…

This checks one thing. A scan reads your whole repository and tells you what an attacker would find first.

Free scan
More tools
Content-Disposition checker Inspect a download header and build one with a safer filename. Log injection checker Find control characters and record-boundary risks in supplied logs. Rate-limit simulator Simulate token buckets and request windows without sending traffic. JWT debugger Decode a token and catch alg:none, a missing expiry, and secrets in the payload. Secret scanner Paste a .env file or a diff and find the keys that should not be in it. CSP evaluator Grade a Content-Security-Policy and see which directive undoes it.