Free to grade. Paid to fix faster and to stay fixed.
The grade and every finding are free. The kit sells the fix for every class. The monitor sells not having to remember.
$0
Every finding, free
- Two grades a day per address, no account. Unlimited for a verified project.
- All 51 passive checks on any URL, including preview URLs. Seven more after you verify ownership, and seven local checks through the CLI with your own keys.
- Every finding with its severity and evidence, and a page per check that explains what it means and how we test it.
- The full fix for the twelve most dangerous classes: secrets in the bundle, exposed env and .git, open admin routes, anonymous row reads, row level security, repository secrets, wildcard CORS with credentials, a test key in production, an unauthenticated sender, an invalid certificate, and a 404 that returns 200.
- A prompt for your coding agent on every check page.
The fix for every class, for you and for your AI
Ten modules. Each one is a human guide (what to decide, what to do by hand, what done looks like) and an AI runbook (ordered steps, a verification after each, a stop before anything destructive). Every check in the grade names its module. What is in each module.
$67one time
- The book: all ten chapters, PDF and markdown
- Human guides and checklists for all ten modules
- AI runbooks and templates for Modules 00 to 03: Foundations, Ship it, Be found, Lock it down
- START-HERE router, AGENTS.md, CLAUDE.md
- At checkout: add the Runbook Pack, Modules 04 to 09, for $27
$197one time
- All ten modules, both documents each, every checklist
- Every template and script: Stripe setup, access-control schema, verify-access script, three canaries, drip sequence, launch kit
- 12 months of module updates, re-download any time
- Already have the Fix Kit? Sign in to your library and pay the difference
$497one round
- Kenny Hyder reads your grade and your repository
- A findings document with each finding mapped to the runbook step that fixes it
- One call, a written sign-off, five business days from access
- Limited each month; if the month is full you are told before paying
Thirty-day refund on the kit, no questions. Prices in USD. Checkout by Stripe. You sign in to your library with a six-digit emailed code; there is no password to lose.
Re-grade on every deploy, and know when something slips
Per project: a grade on every deploy and daily, uptime every five minutes from two regions, alerts when a certificate, a DNS record or a header regresses, a weekly report that sends even when all is clear, history, and a badge with the current grade. What the monitor does.
$15a month
- 1 project
- Re-grade on deploy and daily
- Uptime, cert, DNS and header alerts
- Weekly report, history, badge
$39a month
- 5 projects
- Everything in Solo
- GitHub Action and CLI token for a grade gate in CI
$99a month
- 20 projects, fleet view
- Everything in Builder
- Client-ready PDF report and white-label badge
Annual plans include the Complete Fix Kit. Cancel from the billing portal, any time. Already subscribed? Open your dashboard.
Against what you already have
Your builder scans its own output when you publish. An uptime monitor pings a URL. Both are worth keeping. Neither reads across vendors.
| What is checked | Securealy | Builder's built-in scan | Uptime monitor |
|---|---|---|---|
| Security headers, TLS, cookies, CORS | Yes | Some | TLS expiry only |
| Secrets in the JavaScript bundle | Yes, with the key type | Some | No |
| Exposed .env, .git, backups by URL | Yes, after verification | No | No |
| Database rows readable with the public key | Yes, after verification | Existence of the key only | No |
| Open admin and API routes | Yes, after verification | Some | No |
| SPF, DKIM, DMARC, and the domain your auth emails send from | Yes | No | No |
| Stripe key mode and webhook wiring | Yes | No | No |
| Auth settings: open signup, OTP expiry, redirects | Yes, locally with your keys | No | No |
| A missing page that returns 200 | Yes | No | No |
| SEO basics, robots, sitemap, Open Graph, JSON-LD | Yes | No | Sitemap, sometimes |
| Domain expiry, DNSSEC, CAA | Yes | No | Expiry, sometimes |
| Uptime from more than one region | Monitor | No | Yes |
| Re-grade on every deploy | Monitor | On publish, own checks only | No |
| The fix, as a runbook for a human and an AI | Kit | A prompt, sometimes | No |
| Works on a preview URL before launch | Yes | Own previews only | Rarely |
"Some" means the feature exists in at least one builder we tested and not in others; builders change what they scan without notice, so check yours.