How it works
Short version: add a site, prove it is yours, get findings written in plain English with a fix prompt you can paste into your editor.
1. Add a site
Type the hostname. That is the whole step. Public checks start straight away.
2. Prove you own it
One DNS TXT record, one meta tag, or one small file. Any of the three. Until you do this, KeptShut only looks at what any visitor could already see. That is a legal line, not a marketing tier.
3. Read the findings
Each finding says what is wrong, why it matters, and what a stranger could do with it. Then it gives you a fix prompt to paste into Claude Code, Cursor, or whatever you build with. KeptShut never edits your code.
4. Keep it shut
On a paid plan the checks keep running. If something regresses you get an alert, and your public badge flips from "Kept shut since" to expired. The badge means something because it can go away.
Questions
How long does the first scan take?
Usually under a minute for the public checks. Deep checks on a verified site take a few minutes because they are polite about request rate.
Will scanning slow my site down?
No. The scanner is rate-limited and identifies itself as KeptShut-Verifier in the user agent, so you can see it in your logs.
Do you store my code?
No. Repository scanning reads a checkout, records findings, and throws the checkout away. We store the finding, never the file.