chalo.dev
Sign in
LIVE · v1.0 · PUBLIC SCAN ENGINE

Deep security scanning
for any website.

Chalo inspects transport, security headers, cookies, exposed files, and content signals—then grades the public surface with evidence and remediation. No signup for a lite scan.

Try · ·

Trusted signal forCTOs·Founders·DevOps·Security teams
8
security categories
2
scan modes
A–F
clear security grade
0
agents to install
What we scan

Eight categories. One grade.

Chalo runs real external HTTP and DNS checks—no browser plug-in, no local install, and no access to your infrastructure.

TLS & transport

HTTPS reachability, HTTP→HTTPS redirect, HSTS enforcement.

Security headers

CSP, X-Frame-Options, XCTO, Referrer-Policy, Permissions-Policy.

Cookie hygiene

Secure, HttpOnly, and SameSite flags on every Set-Cookie.

Exposed files

Probes .env, .git, config backups, phpinfo, server-status, .DS_Store.

DNS posture

A/AAAA/NS, CAA restrictions, IPv6 availability via DoH.

Email security

SPF strength, DMARC policy, MX visibility.

Server fingerprint

Detect leaked Server / X-Powered-By banners.

Content integrity

Mixed-content sweep, robots.txt review.

How it works

From URL to a prioritized security signal.

01
Enter a URL

Any public hostname. No agent, no install, no permissions.

02
Chalo probes in parallel

Edge workers hit TLS, headers, DNS, and known-risky paths concurrently.

03
Grade + fix

You get an A–F grade, per-category breakdown, and copy-pasteable remediation.

Coverage

One scan instead of five tools.

CapabilityChaloTLS-onlyManual review
TLS & HSTS enforcement
Security headers + CSP
Cookie flag hygiene
Exposed file probes (.env, .git)
DNS + CAA posture
SPF / DMARC email security
Single A–F grade with fixes
JSON API + score badge
Automate it

Scan on every deploy.

Chalo speaks plain JSON over HTTPS. Use the current public endpoint in a shell step or terminal; native CI integrations are planned.

CI shell step
- name: Chalo security scan
  run: |
    curl -s -X POST https://chalo.dev/api/public/scan \
      -H 'content-type: application/json' \
      -d '{"url":"${{ env.SITE_URL }}"}' | tee report.json
One-liner (cURL)
curl -s -X POST https://chalo.dev/api/public/scan \
  -H 'content-type: application/json' \
  -d '{"url":"example.com"}' | jq '.grade, .score'
README badge
![Security grade](https://chalo.dev/api/public/badge.svg?score=92&grade=A)
Trust model

Technical signal without security theater.

Read-only by design

Chalo makes external requests and DNS lookups. It does not exploit, fuzz, or modify the target.

Evidence before claims

Every finding stays connected to what the scanner observed and where the check stops.

A signal, not certification

A strong grade does not mean vulnerability-free and never replaces a penetration test.

FAQ

Answers, before you ask.

Yes. Chalo performs read-only, unauthenticated probes — the same requests a browser or search crawler would make. No exploitation, no fuzzing, no writes.
Pricing

Simple, honest pricing.

Free
$0

Public one-off scans.

  • Public lite scan
  • No signup required
  • Evidence and remediation
Start free
Pro
Popular
$12/mo

Product direction for individual builders.

  • Deep scans
  • Saved scan history
  • Public report sharing
  • Billing activation coming soon
Create account
Team
$49/mo

Planned team workspace tier.

  • Team workspace planned
  • Managed API keys planned
  • Scheduled scans planned
  • Slack alerts planned
Contact us

Grade your site in seconds.

No install. No signup for the lite scan. Just paste a URL and watch Chalo work.

Run a scan