Your AI reviewed the code. It never saw the live site.

Code review and live-site scanning catch different problems. Both matter. Neither one covers for the other.

AI / code review

Reads your source and reasons about what could go wrong before you ship. Genuinely useful for bugs, logic errors, and unsafe patterns.

Blind to: what your deployed site actually exposes: the headers your host sends, the cookies your framework sets, the files your build left behind, the certificate your platform provisioned. It's reasoning about code, not looking at a running site.

GuardDuck / live-site scanning

Loads your site the way an attacker would (from the outside, no source, no access) and reports exactly what's exposed: missing headers, insecure cookies, login forms over HTTP, leaked config, expiring certs. These are deployment-time problems that only exist once the site is live.

Blind to: your authorization rules, your business logic, your database policies. We can't read code we can't see, and we don't pretend to.

What a scan from the outside can and can't find

We find exposure that is concrete, deployment-time and verifiable from the outside: a reachable .env, a cookie without HttpOnly, a missing HSTS header, a certificate about to lapse.

We do not find broken access control, IDOR, misconfigured row-level security, or business-logic flaws, the bugs where the site works exactly as built but the logic is wrong. No black-box scanner can, because those live in code and rules we never see. We also don't validate the full certificate trust chain, detect subdomain takeover, or analyze your source or dependencies. For any of that, you want code review, a human reviewer, or a pentest.

When we hit that line, we say so in the scan itself. Every finding carries a plain label:

  • Confirmed issue:we saw it fail.
  • Advisory: hardening suggestion:worth tightening.
  • Could not verify externally:we looked, and we can't be sure from out here.
A black-box scan cannot see this from the outside… an absence of evidence here is not evidence that the problem exists.

A tool that tells you where it stops is worth more than one that guesses.

Built for Founders, Vibe coders and Developers shipping fast.

Hand the prompt to your AI and let it run the black-box scan for you

Fetch https://guardduck.co/scan/.md and explain the findings.