HATS by ContAlert

Find the security gaps in your SaaS before attackers do.

HATS is a browser extension for founders and developers. Open your app, click the hat, and get a grade from A to F with every gap that leaves your users exposed.

Add to Chrome (coming soon) See pricing

Runs in your browser. Your browsing data never leaves it.

What HATS checks

Leaked secret keys

Stripe, AWS, GitHub, AI providers, Supabase service_role and private keys shipped in your JavaScript.

Public source maps

Map files that hand anyone your original, un-minified source code.

Security headers

CSP, HSTS, clickjacking protection, nosniff, Referrer-Policy and technology leaks.

Session cookies

Session cookies readable by scripts, sent without HTTPS or on cross-site requests.

HTTPS

Pages, forms and resources still served over plain HTTP.

Email spoofing

Missing or weak SPF and DMARC records that let anyone send email as your domain.

Pricing

Free

$0
  • Unlimited scans
  • Grade from A to F
  • The list of issues found

HATS Pro

$1.90 / month
  • Everything in Free
  • Where each issue is
  • Exactly how to fix it
  • Cancel anytime

Prices in US dollars. Sales tax or VAT may be added depending on your country. Payments are processed by Paddle, our reseller and merchant of record.