Did I ship a dev server?
If your live site runs vite or npm run dev instead of serving a production build, anyone can load your source files, and older Vite versions have known bugs that let anyone read files like .env. Paste your URL and we'll check whether the Vite dev server is answering.
Uses 1 of your 3 free scans today; a site scanned in the last 24 hours answers from that scan. Passive and read-only: we only look at what any browser can see. Only check sites you own or may test.
What this checks
From the page and scripts every free scan already loads, we look for two things together: a <script type="module" src="/@vite/client"> tag on your page, and that script being Vite's hot-reload client. A page that only mentions it (like docs) doesn't count, and neither does a template that loads the dev client from localhost (that dev server isn't public). We never request dev-server-only paths and never try the file-read bugs.
Check it yourself
Run these against your own site.
curl -s https://your-app.com/ | grep -o 'src="/@vite/client"' curl -s https://your-app.com/@vite/client | grep -c "\[vite\] connecting"
If the first prints the tag and the second prints a number above 0, your live site is the dev server. A production build has neither.
If it's the dev server
Change your deploy to run vite build and serve the built dist/ folder from a normal host. Never run vite or vite --host on a public port. Then upgrade Vite. Two advisories cover the dev-server file-read bugs, each fixed in different versions:
- GHSA-v2wj-q39q-566r (CVE-2026-39364): fixed in 8.0.5 and 7.3.2.
- GHSA-fx2h-pf6j-xcff (CVE-2026-53571): fixed in 8.0.16, 7.3.5 and 6.4.3.
Upgrading to 8.0.16, 7.3.5 or 6.4.3 or later covers both. If the dev server was public, rotate the keys in your .env too.
Questions
Is it safe to run vite dev on a public server?
No. The dev server is built for your own machine: it serves your source files, and known bugs in older versions let anyone read files it should block, such as .env. Serve the output of vite build instead.
Which Vite versions fix the dev-server file-read bugs?
GHSA-v2wj-q39q-566r (CVE-2026-39364) is fixed in 8.0.5 and 7.3.2. GHSA-fx2h-pf6j-xcff (CVE-2026-53571) is fixed in 8.0.16, 7.3.5 and 6.4.3. Upgrading to 8.0.16, 7.3.5 or 6.4.3 or later covers both.
Does this tool test the bugs?
No. It only checks whether the dev server is running, from the page and scripts any browser loads. It never tries to read your files.
Does this use one of my free scans?
Yes. It runs the normal free scan, which allows 3 scans a day. A site scanned in the last 24 hours answers from that scan without using another one.
Check everything, not just this
The full free scan also looks for leaked API keys, exposed .git folders, source maps and missing security headers. Same 3 free scans a day.