Security analysis for your app
ecoa runs automated security, privacy and LGPD (Brazilian data protection law) compliance analysis on your app, AI-built or hand-coded. You get a report with the flaws found, the severity of each one and what to do to fix them, before you launch.
Analyze my app for freeWeb application security scan
From your app's public URL, ecoa checks its external security posture, with nothing to install.
Headers and transport
- Content-Security-Policy (CSP), X-Frame-Options, HSTS, X-Content-Type-Options and Referrer-Policy
- Valid TLS/SSL certificate and mandatory HTTP to HTTPS redirect
- Permissive CORS configuration and mixed content loading (HTTP on an HTTPS page)
Cookies and exposure
- Secure, HttpOnly and SameSite attributes on cookies
- Secrets in public JavaScript files and exposed configuration files (.env, .git)
- Exposed admin endpoints and missing rate limiting
Static source code analysis (SAST)
When you connect your repository, ecoa audits the code for vulnerabilities before they reach production.
Vulnerabilities and dependencies
- SAST with Semgrep for SQL Injection, Cross-Site Scripting (XSS) and authentication flaws
- AI semantic review to discard false positives
- Dependency audit (package.json, requirements.txt) against known public CVEs
Leaked secrets
- Scan of the Git commit history for private keys, API tokens, passwords and credentials
LGPD compliance
Automated compliance audit against the LGPD, Brazil's General Data Protection Law (Law 13,709/2018), combining web crawling and AI analysis.
What is checked
- Cookie consent banner visible on the home page
- Public, active privacy policy on the main routes
- Contact channel for the Data Protection Officer (DPO), required by Art. 41
- Data subject rights guarantees: access, correction, deletion and portability (Art. 18)
- Declaration of legal bases, purposes and retention periods (Arts. 7 and 9)
How it works
Register your app
Provide the app's public URL (or connect the repository for code analysis). For active scans, domain ownership is validated first.
Run the analysis
Choose which checks to run: web security, code or LGPD. ecoa runs the scan and calculates a compliance score.
Get the actionable report
Every finding comes with a category, severity (critical, high, medium, low) and remediation guidance. Fix and run again to track your progress.
Frequently asked questions
Does ecoa run application security analysis?+
Yes. ecoa runs automated security scans on web apps from their public URL (HTTP headers, TLS, cookies, CORS, exposed secrets), static source code analysis with Semgrep (SQL Injection, XSS, authentication flaws, CVEs in dependencies and secrets in the Git history) and an LGPD compliance audit.
Do I need to know how to code to use it?+
No. The web security scan and the LGPD audit work with just the app's URL. Code analysis requires connecting the repository, but the report is written in plain language, with the severity of each issue and what to do to fix it, designed also for people who built their app with AI.
Does ecoa check LGPD compliance?+
Yes. The LGPD analyzer checks for a cookie consent banner, an active privacy policy, a contact channel for the Data Protection Officer (DPO, Art. 41), data subject rights guarantees (Art. 18) and the declaration of legal bases and processing purposes (Arts. 7 and 9).
Which vulnerabilities does the code analysis find?+
The static analysis (SAST) uses Semgrep to detect SQL Injection, Cross-Site Scripting (XSS) and authentication flaws, filters false positives with AI, audits dependencies against known public CVEs and scans the Git history for exposed keys, tokens and passwords.
How much does a security analysis cost?+
There are free checks and deeper tiers available in the plans. Creating an account is free.
Launch safely and on the right side of the law
Create your free account, run your app's security and LGPD analysis and get real feedback from real people.
Create free account