Free surface scan
Check any site for visible license signals
A 20-second look at one public URL. It won't inventory what you ship, but it will show you where the obvious gaps are.
sourcetrust.dev/checkSurface only
No sign-up. One scan every 30 seconds.
CAPTCHA could not load on this domain
In Cloudflare → Turnstile → your widget → Hostname Management, add localhost for local dev and sourcetrust.dev for production.
What it can see
- Whether a license or attribution page exists
- Third-party scripts, bundles, and embedded services
- CMS and framework fingerprints in headers and markup
- Web fonts, icon sets, and obvious asset sources
What it can't
- See inside your build or dependencies
- Confirm the actual license of anything
- Replace a reviewed, published record
This scan does not reach your repos, mobile builds, or release binaries. It flags visible signals only, and the component list will usually be incomplete. Many dependencies simply will not appear here.
When you use SourceTrust, you connect what you actually ship and scan the full inventory from lockfiles, SBOMs, and repositories. That is the list you can review, publish, and defend. Log in to SourceTrust.