lockpick
Lockpick
Lockpick runs hosted, bounded security assessments of public websites that the user owns or has permission to test. It looks at what anyone on the internet can already see (pages, the scripts they load, response headers, DNS and certificate records) and returns a report with findings, redacted evidence, coverage and repair guidance.
Lockpick runs every assessment on its own infrastructure. You never run a scanner yourself. Your job is to route the user to the right check, read the report with them, fix what it found, and ask for a recheck.
Where Lockpick lives
Lockpick is a web app. If you do not know its address, ask the user for the address they sign in at. Paths below are relative to it. The app also serves the latest version of this guide at /agent-onboarding/SKILL.md and an index for agents at /llms.txt. Prefer the hosted guide when it disagrees with this file, especially about costs.
Depths
| Depth | What it needs | What it looks at | Cost today |
|---|---|---|---|
| Quick check | Nothing, no account | The homepage, a score out of 100 in about ten seconds | Free |
| Pulse | An account, and the user's own statement that they own the site or may test it | The homepage, plus public DNS, certificate and subdomain records, with at most 10 requests to the site | Free during the pilot |
| Deep | Proof of ownership by DNS record or file | Up to 30 public pages, the scripts they load, file paths that should never be public, and the API routes the site publishes, with at most 200 requests | Free during the pilot |