The door looks shut.
KeptShut checks the latch.
You shipped it alone. Nobody is watching your API spend, your server panel, your domains or your repo. KeptShut watches all four, explains what is wrong in plain English, and hands you a fix you can paste straight into your editor.
In one line: KeptShut is continuous security monitoring priced for one person, covering the operational and money-losing gaps that platform tools leave open.
What we watch
Live exposure
A web-readable .env, a committed CLAUDE.md, an admin route with no auth, a debug page left on. The things that get found in minutes.
Repository
Committed secrets, packages that do not exist, routes with no server-side check, and malicious-package alerts on every push.
Bill shock
A leaked key gets abused in minutes, not days. We watch spend velocity across your providers and can revoke the key before the bill lands.
Panel watch
Your control panel version against the known-exploited list, with the exact patch command. Whole panels have been ransomwared inside 72 hours.
Domain posture
Transfer lock, registry lock, DNSSEC, CAA, expiry runway, dangling DNS, and whether your recovery email is in a breach dump.
The badge
"Kept shut since" a real date, on a public page. It expires the second something regresses, so it is worth something.
Common questions
What does KeptShut actually watch?
Five things a solo operator cannot watch alone: your live site for exposed files and missing auth, your repository for committed secrets and fake packages, your provider spend for a runaway API key, your server panel for a known-exploited CVE, and your domains for lock, DNSSEC and expiry problems.
Do I have to prove I own a site before you scan it?
For public checks, no. Anything active or deep needs proof of ownership first, using a DNS TXT record, a meta tag or a small file. That is a legal line, not a preference. KeptShut will not probe a domain you have not proven you control.
Is there a free plan?
Yes. One verified site, one scan, public checks only, and the badge. No card needed.
What is the "Kept shut" badge?
A public page and an embeddable image saying "Kept shut since" a date. It expires the moment a monitored check regresses, so it means something. A badge that never expires is decoration.
Will you fix the problems for me?
Every finding comes with a paste-ready fix prompt written for Claude Code, Cursor or whatever you build with. KeptShut never changes your code by itself.
One scan. No card.
Prove you own the site, run the free scan, and see what a stranger could already see.
Start the free scan