Automatically scan your ASP.NET Core application for vulnerabilities - exposed developer exception pages, missing anti-forgery tokens, misconfigured CORS, and OWASP Top 10 issues.
No installation · No credit card required · Results in 5 minutes
What we check
Why ASP.NET Core Security Scanner
app.UseDeveloperExceptionPage() is ASP.NET Core's equivalent of Laravel's APP_DEBUG or Django's DEBUG=True - a development convenience that returns full exception details, stack traces, and query information in the response when left active in production. It's typically only one line, conditioned on the environment, but that condition is exactly what gets missed when an environment variable isn't set the way a deployment script assumes it is.
Unlike Rails or Django, ASP.NET Core's anti-forgery (CSRF) protection is not automatically applied to every state-changing endpoint - MVC views using the Html tag helpers get it by default, but Razor Pages, minimal APIs, and any endpoint built without those helpers need [ValidateAntiForgeryToken] or an explicit global filter added deliberately.
appsettings.json commonly holds connection strings and API keys, and a misconfigured static file middleware or a build that copies it into a web-servable output directory can expose it directly - confirm it's genuinely unreachable via a direct request, not just absent from source control.
How it works
Create a free account and enter your site's URL. No installation or configuration needed.
Shieldome performs passive checks across 100+ security and performance vectors in minutes.
Get a detailed findings report with severity ratings and copy-paste remediation guidance. Export as PDF, JSON, SARIF, or CSV.
Join thousands of developers and security teams who use Shieldome to keep their sites safe.
First scan is free - no credit card required.
Free Security Tools - No Login Required