Scanmysaas scores 82/100, with its strongest evidence in accessibility, writing quality, usability, and site stability. Its most material weaknesses are homepage performance, design execution, and decision-support detail, all of which have clear next steps.
Reviewed by SiteList Engine · 12 of 13 dimensions · published Reviewed on October 25, 2026
Is this your site?
Claim itScanmysaas is an outside-in web vulnerability scanning product for SaaS applications.
| Fact | Value |
|---|---|
| Domain | scanmysaas.com |
| Category | Outside-in web vulnerability scanning for SaaS applications |
| Pricing | Not classified in the supplied site facts |
| Pages crawled | 20 |
| Crawl date | 2026-10-18 |
Scanmysaas earns 82/100 because its strongest public surfaces are accessibility, writing quality, usability, and site stability. Accessibility leads the supplied dimension table at 96/100, followed by writing quality at 91.7, risk and stability at 89.3, and usability at 88.7.
The site makes its audience and core use case legible quickly: it serves SaaS founders and small product teams, including teams using AI coding tools, with a browser scanner, repository scanner, and security guides. The pricing and guide surfaces answer practical questions about scope, credits, and next steps. The supplied technical SEO summary also describes the 20-page sample as broadly crawlable, indexable, and server-rendered, with 18 public URLs in the verified sitemap.
The main drag is concentrated in performance, design execution, and decision support. Performance scores 70.2 and design execution 70.4; the supplied lab measurements call out the homepage as the clearest performance concern, while the design score leaves room to refine the interface. Decision-support surfaces score 74 despite a clear pricing comparison. These are focused improvements, not a change to the product's basic positioning.
ScanMySaaS makes its core offer legible within 10 seconds: a browser-based security scanner for SaaS founders and small product teams. The hero names teams shipping with Cursor, Claude, Codex or Lovable, then grounds the promise in an outside-in scan for exposed files, unsafe headers and risky cookies. Scope is tangible: 60+ vulnerability checks, 25 pages per scan, 15 security categories, and a sample report. The site also sets a useful boundary by saying the result is not a certification or penetration test. Its open question is distinction. The supplied evidence contains no attributable customer outcome, and the competitive frame remains a product assertion beside Burp Suite, Nikto, manual testing and certification. Add one concise comparison and a named release story with the finding, fix and retest result.
The site answers a SaaS founder's first questions with unusual clarity: what is scanned, what it costs, how much a scan covers, and how the result differs from a penetration test. The homepage addresses AI-assisted builders, pricing distinguishes a founder shipping one or two products from teams checking multiple apps and environments, and the footer names SaaS founders and small product teams. The FAQ also separates public deployment scanning from repository scanning and states that the repository scanner does not clone, install, build or execute code. The remaining messaging gap comes after a finding: the supplied evidence does not provide an SLA or detailed support path for false positives, verification or disputed results. Add a short limits-and-support panel, then pair it with one named scan-to-retest story.
A first-time visitor can understand the offer within 10 seconds, and the main discovery paths are easy to follow. Pricing is one click from the homepage and compares Free ($0 once), Starter ($29 per month) and Pro ($79 per month), including credits, rollover limits and upgrade differences. The guides hub uses goal-shaped titles, reading times and a consistent Read guide action. The main friction sits at the highest-value action: Run a free scan resolves to the #scan handoff, but the supplied rendered inventory exposes one GET input field and no button entry. That supports an unclear transition, not a claim that submission is broken. Add a visibly labeled action plus a post-submit confirmation or next-step state. Contact is complete once reached, but currently depends on the footer rather than primary navigation.
ScanMySaaS has a strong accessibility baseline: sampled pages expose header, nav, main and footer landmarks, heading sequences are structurally ordered in the supplied DOM facts, and the homepage URL input has a wrapping label with aria-label="Website URL". The homepage received a PSI accessibility score of 96. Two automated gaps are actionable. PSI reports a failed color-contrast audit on the homepage, the launch-security guide and the privacy page, but the supplied result does not identify the affected elements or ratios. PSI also reports a link-in-text-block failure on /privacy, where prose links need a non-color distinction. Retrieve element-level contrast output, correct the affected pairs, and add underlines or an equivalent cue to privacy-page prose links. Keyboard order, focus behavior and error announcements remain unverified.
The interface has a coherent dark-and-lime point of view, with repeated card patterns and a clear mobile hierarchy. The homepage H1 measures 44.8px against 18px paragraph text, the four supplied 390px layout checks report scrollWidth390: 390, and the viewport permits scaling with maximum-scale=5. Execution weakens in interaction details. The four mobile captures report 17, 16, 18 and 15 small tap targets—66 in total—and the repeated menu button measures 38×38px on three captures. The /repo-scan input uses a 14px computed font at 390px. PSI also fails color-contrast audits on the homepage and launch checklist guide. Raise controls to at least 44×44px, set the input to 16px, retrieve the failing contrast pairs, and make one of the two lime first-viewport actions dominant.
The homepage is a clear mobile lab outlier: LCP is 9,009.643 ms, versus Google's 2.5-second good threshold, while the sampled article reaches 1.821s, registration reaches 1.352s, and the desktop homepage reaches 0.613s. These are lab results; the reports contain no field metrics. Server response is not the observed bottleneck at 2ms on the homepage and 1ms on registration, and homepage CLS is 0. The page transfers 2,547 KiB across 50 requests, including 1,345 KiB attributed to YouTube domains, with 589 KiB of estimated unused JavaScript and 110 KiB of unused CSS. Trace the exact LCP node first, then defer below-fold video, remove route-unused code and CSS, and enforce route budgets with repeated mobile checks.
ScanMySaaS's writing is concise, technically specific and aimed at real founder workflows. The homepage H1, "SaaS security scanner before your next launch," and the supporting question about Cursor, Claude, Codex or Lovable identify both the use case and audience in the first viewport. The guides name concrete subjects such as Supabase RLS, GitHub Actions, HSTS and CSP rather than relying on broad security language. The voice is also appropriately bounded: the site says automated checks are not a substitute for a penetration test. The main editorial fixes are small but worthwhile: separate guide titles from metadata inside card links, and give /dashboard a unique title and meta description rather than sharing the login wording.
The pricing page makes the commercial shape easy to verify: Free is $0 once, Starter is $29 per month for 10 credits, and Pro is $79 per month for 30 credits. It also states the 25-page scan limit and rollover caps of up to 20 and 60 credits. The decision layer stops short of being fully useful. Starter carries a Most popular label and audience labels distinguish founders from teams, but the page does not state when a visitor should choose Starter over Pro or what trade-off comes with staying on Free. Finding descriptions and Saved scan history are checkmarked for every plan, so neither row helps a buyer choose. Replace identical rows with plan-specific limits or remove them, then add explicit Free, Starter and Pro guidance.
The supplied crawl shows a stable public surface, with no sitewide noindex, robots block, mass-5xx cluster, redirect loop or client-side metadata conflict. Public URLs are indexable, robots.txt allows the public surface, the sitemap is verified, and raw and rendered samples align; login and dashboard noindex behavior is treated as intentional auth gating. The clearest avoidable exposure is host normalization: http://scanmysaas.com/ takes a 308 followed by a 307 before reaching https://www.scanmysaas.com/. The homepage mobile lab result adds directional acquisition risk at 9,009.643 ms LCP, but no field metrics are present. Domain history is limited: registration is 2026-02-14 and Wayback has three 2026 snapshots. Collapse the redirect chain, improve the mobile first viewport, and connect Search Console for a real baseline.
The guides show disciplined editorial work: they reference established frameworks such as OWASP, provide step-by-step remediation guidance, and avoid generic introductory filler, repetitive list patterns and unsupported statistics. Structured FAQPage and Article markup matches visible prose on key pages. The remaining issues are precise and easy to isolate. The /dashboard route carries a canonical pointing to /login, which can create confusion about the intended canonical page. The /guides/llms-txt-for-saas title is 67 characters, above the supplied 60-character recommendation. Correct the dashboard canonical if it is intended as a standalone route, and shorten the guide title while preserving the topic and site name.
ScanMySaaS has a useful documentation base: the /guides hub lists ten security guides, including a launch checklist updated September 6, 2026, with seven numbered checks and a find-fix-retest worksheet. The homepage also exposes six FAQ answers, and /llms.txt supplies a structured product summary. Findability is the main constraint. The hub reports no search box, sidebar navigation or breadcrumbs, so the ten-card catalogue will become harder to use as it grows. Sampled technical pages also report zero code blocks; readers must translate prose into configuration or commands. Add full-text search and topic grouping first, then give each major task a copy-paste example, expected result and verification step. The visible August 13 and September 6 update dates show that freshness is not the current concern.
The supplied 20-page sample is broadly crawlable, indexable and server-rendered. robots.txt allows the public surface, the verified sitemap contains 18 public URLs, raw and rendered word counts match, and the homepage publishes Organization, WebSite, SoftwareApplication and FAQPage JSON-LD. Response headers also show HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY and a restrictive Permissions Policy. Three fixes deserve priority. The HTTP root reaches the canonical host through 308 then 307; collapse that into one permanent redirect. Homepage mobile PSI reports 9,009.643 ms LCP, 6,843.640 ms FCP, 589 KiB unused JavaScript and 110 KiB unused CSS; reduce the initial render path and retest. Finally, renew the sampled certificate before its 2026-11-20T21:52:24Z expiry.
Scanmysaas is a strong choice for SaaS founders and small product teams that want an automated outside-in assessment as part of a broader security process. Its clearest advantages are the direct founder-focused writing, strong public-page accessibility evidence, understandable usability, and a stable, broadly crawlable public surface.
The next work is specific: improve the homepage's lab performance, refine design execution, and strengthen decision-support detail around the path from pricing information to action. The product should also keep its capability boundary clear: a scan is not a security certification or penetration test.
This fits teams shipping public SaaS applications, particularly teams using AI coding tools, that need a fast feedback layer. It is less suited to anyone looking for certification or a substitute for broader security work.
This 13-dimension review combines the supplied 20-page public crawl from 2026-10-18, product facts from the homepage and pricing page, the public dimension score table, and supplied accessibility and lab-performance measurements. The crawl also provided the basis for the public-page, guide, pricing, sitemap, and technical SEO observations. Performance measurements are lab-only and describe the supplied crawl conditions rather than real Chrome users.
The supplied site facts do not classify a pricing model or USD range, so this article does not invent one. Product facts do confirm scan-credit limits, rollover caps, and the boundary that results are not certification or penetration testing. Search Console enrichment was not connected or available for this review.
Dimension 13, Review-content integrity, was excluded as not applicable. The remaining published score table covers the dimensions used for this article. Read how SiteList scores for the full review method.
Scanmysaas is aimed at SaaS founders and small product teams shipping public apps, including teams using AI coding tools. It provides an automated outside-in view of a website and repository signals.
One credit runs a new crawl and security report for one website. A scan can cover up to 25 reachable pages on that site.
Yes. Starter can hold up to 20 credits and Pro can hold up to 60. New monthly credits are added up to the relevant cap.
No. It is an automated outside-in assessment, not a certification or penetration test. Use it as a fast feedback layer within a broader security process.
The homepage received a PSI accessibility score of 96 and showed strong semantic structure. The supplied evidence also identifies automated contrast failures on the homepage and guides.