How to Run a Free Reeve Scan on Your App or Website

Paste your app or website URL into the scan box on reeve.page, tick the ownership/permission checkbox, and click "Scan my app, free." About 20 seconds later you get an A–F safety grade plus a list of what's wrong and what you got right. No install, no signup, and the check is read-only from the outside — Reeve states it never touches your data.

Before you scan

• A live URL. The scan is an external check, so your app or site needs to be reachable on the internet. Local-only builds won't work.
• Permission. You must own the app or have permission to scan it. The checkbox on the page is how you confirm this.
• Agreement to the terms. By scanning you agree to Reeve's Terms of Service and Privacy Policy.
• No account needed. The free scan is listed as free with no signup, so you can run it before deciding whether you want anything more.

Step-by-step

1. Go to reeve.page.
2. Enter your app or website address in the field (the sample shows a format like your-app.com).
3. Check the box confirming you own the app or have permission to scan it.
4. Click Scan my app, free.
5. Wait roughly 20 seconds. The report screen shows a progress state ("Scanning your-app.com") before results appear.

What the report gives you

The result is a letter grade (A–F) with a numeric score — the sample shows a B / 80 out of 100 — plus a per-check breakdown. Each item is marked with a status and a severity level, and the report explicitly calls out things you got right, not just failures. The sample report shows:

Reeve describes this as the same nine checks it runs across apps, and labels it an automated external check rather than a full audit — worth keeping in mind when you read the grade.

What the nine checks cover

Based on Reeve's published scan data, the checks include security headers, cross-site sharing, source maps, database access, exposed secrets, and storage buckets. The most common finding by far is missing security headers (seen in 99% of scanned apps, up to Medium severity). Rarer but more serious: exposed secrets (4%, up to Critical) and database access (8%, up to Critical).

If your app uses Supabase, the database and storage checks are the ones to read closely. Reeve reports that of 3,680 reachable Supabase databases, 57% had tables a stranger could read — the failure mode where one open database exposes everything at once.

Common snags

• Scan won't run: the URL isn't publicly reachable, or the permission checkbox isn't ticked.
• Grade looks fine but you're unsure: the scan is an outside-in automated check, not a full audit. Treat a good grade as "no obvious external leaks found," not "certified secure."
• You want ongoing coverage rather than a one-time result: that's a separate product question — see the next section.

If you want more than a one-time scan

The free scan tells you what's wrong once. Reeve also describes a monitoring and backup offering ("Reeve Care") that watches the app and backs it up, plus an "undo button" framing for restoring your app. Pricing and plan details aren't specified in the material here, so check the Pricing page at reeve.page/pricing for current terms before assuming what's included or free beyond the scan.