→ Security snapshot · 2026-05-30

How secure is this site, on the surface?

height.app

A read-only public-posture snapshot. We hit height.app the way any anonymous visitor would, recorded what came back, and graded it against modern best practices. This is not a pen test — it covers maybe 5% of what a real assessment would look at. If you own this domain and want the other 95%, the free scan is below.

A
Overall public posture grade. Based on HTTPS enforcement, security-header completeness, TLS configuration, and information disclosure. No issues observed at this depth — but again, this is the surface only.
Run a deeper free scan →
→ How height.app compares
A ← here
65
A-
6
B
112
B-
0
C
0
D
0

Across 183 publicly-known SaaS targets we've snapshotted, 36% sit at grade A, and 0% score higher. The grade is absolute, not relative — but seeing where peers cluster makes it concrete.

→ Need the real thing? Senior-engineer pen test for height.app.
A surface snapshot is 5% of the picture. Our $4,999 pen test covers auth, IDOR / BOLA, BFLA, GraphQL, mobile, and ships an enterprise-grade PDF + retest.
Get a pen-test quote →
→ Want this report by email?
We'll email you a link to this page + alert you when the next refresh runs (we re-snapshot weekly). No signup.

What we observed

INFORMATIONAL Host not publicly reachable

Either the domain doesn't resolve, the server is down, or our probe is blocked.

Server details (what's exposed publicly)

HTTPS reachable
no
HTTP redirects to HTTPS
no
TLS protocol
—
Server header
(hidden)
X-Powered-By
(hidden)
Cert expires
—

Want the deep version?

The full free scan runs ~600 nuclei templates against height.app, checks the authenticated TLS surface, audits headers and DNS, and emails you a PDF with prioritized findings + fix instructions. Three minutes, no signup.

Run the free scan →

This snapshot is a public read-only view, like loading the site in a browser. We did not run vulnerability templates, did not test authenticated endpoints, did not attempt to bypass any controls. The data shown is observable by anyone with curl. If you own height.app and want this page removed or refreshed, email security@thecybergrid.com.