What the scan looks for
Exposed files and secrets: API keys, tokens and private keys inside your HTML and scripts; public .env, .git and config.json files; and source maps that publish your original code. Security: HTTPS and the redirect from plain HTTP, the main security headers, cookie flags, mixed content and a security.txt contact. Search and sharing: the title, description and Open Graph tags, robots.txt, sitemap.xml and any noindex left over from staging. Basics: the viewport, page language, favicon, and links to a privacy policy and terms.
If a key turns up
Treat it as leaked, even if the site isn’t public yet. Revoke or rotate it with the provider first, then move it out of front-end code into a server-side environment variable or a backend function. Keys meant for browsers, such as publishable payment keys or restricted map keys, are fine to ship, but lock them to your domain in the provider’s dashboard.
What it can’t see
It checks the homepage and the files it links to, not every page. Content that only appears after JavaScript runs, pages behind a login and server-side code aren’t visible to it. A clean scan means the common launch mistakes are covered, not that the site is fully secure.