Paste the URL. You get back the keys sitting in your JavaScript, the security headers you are missing, and whether your original source is downloadable. No signup, no account, nothing stored about you.
Your database is never contacted. This reads the page and the JavaScript it links, exactly as a browser would, and checks the response headers. It also requests a few well-known paths like /.env and records only the status code — never the contents. If it finds a key, it tells you the key is exposed. It does not go and use it to read your users' data, which is what several other scanners do to make the point.
What a scanner physically cannot see: whether Row Level Security is actually on, whether one of your users can read another's data, and the logic failures that never throw an error — like an assistant offering a 09:00 appointment at 16:21, with a confirm button. Every finding in a paid report is reproduced by hand before it reaches you.