Twenty-two checks · read-only
Find what your app left open
Paste your repo. Twenty-two checks read it the way an attacker would, and every finding comes back in words you already use — with the exact fix.
Read-only. No card for the free scan.
Made for apps shipped on
- Lovable
- Bolt
- Replit
- Cursor
- v0
- Base44
- Claude
- Windsurf
It is not your fault
AI writes code fast. It does not write it safe. Four patterns turn up in almost every AI-built app we read.
Speed is the point
AI builders are tuned to get something working in a weekend, not to lock it down. Security is the step that quietly gets skipped.
Secrets get hard-coded
The fastest way to make a key work is to paste it into the code. It works — and then it lives in your history forever.
Defaults ship wide open
New databases and endpoints often start fully public. Unless someone tightens them, your data is one guessed URL away.
Nobody reviews it
There is no senior engineer reading the diff. What ships is whatever the model wrote, flaws included.
Nothing quietly skipped
Twenty-two checks run on every scan. When one of them cannot reach something, it says so — it never counts as a pass.
- 01
Leaked passwords and keys
We read your entire code history for API keys, database passwords and secrets that got committed — including ones you thought you deleted.
- 02
Secrets exposed to visitors
Some keys are meant for your server alone. We catch the ones shipping to every visitor's browser, where anyone can take them.
- 03
Unlocked back doors
Actions like deleting data or changing an account, which anyone can trigger without logging in.
- 04
Peeking at other people's data
Places where one signed-in user can load another user's private records by changing a number in the URL.
- 05
Risky building blocks
Your app stands on open-source packages. We check them against a live vulnerability database and name the dangerous ones.
- 06
Weak website protections
On your live site, the settings that block clickjacking, cookie theft and the rest of the common attacks.
- 07
Publicly readable database
If you use Supabase, we test what a stranger can read from your database. Common, and serious.
- 08
Fakeable payments and uploads
Whether a payment confirmation can be forged, and whether a file upload can be turned against your app.
- 09
Injected commands and queries
Where visitor input lands straight in a database query, a server command or your pages — the classic takeover.
- 10
Requests to places you didn't mean
Whether someone can make your server fetch an address of their choosing, and reach things only it can see.
- 11
Cookie flags and sharing rules
Whether your session cookies can be read by script, and which other sites your app agrees to talk to.
- 12
Sign-in attempt limits
Whether someone can sit and guess passwords against your login as fast as their machine allows.
- 13
Secrets in the delivered code
When there is no history to read — a zip, an exported folder — this is the one that still finds the live keys sitting in the files.
- 14
The money path
Whether your app charges honestly once someone is already paying: duplicate credits, quantities taken from the payment event, balances written in three steps instead of one.
- 15
Unchecked input
Endpoints that take whatever a visitor sends and use it as-is — wrong types, missing fields and oversized values reaching your database untested.
- 16
Fields you never offered
Whether a visitor can add their own fields to a form submission — a role, a price, someone else's id — and have them saved.
- 17
Unguarded public forms
Contact, lead and signup forms with nothing between a script and the submit button: the spam floods and the inbox bills.
- 18
Over-sharing responses
Endpoints that return every column of a user record, including the ones that should never leave the server.
- 19
Secrets stored in the clear
Passwords, tokens and identity numbers written to your database as typed, readable by anyone who reads the database.
- 20
Redirects to anywhere
Links that start on your domain and, through one unchecked parameter, land the visitor on someone else's.
- 21
Errors that explain too much
Failure responses that hand the visitor file paths, library names and database details — a map for the next attempt.
- 22
Code that runs on install
Which of your packages execute a script the moment they are installed, on every machine that builds your app.
Three minutes of yours
An attacker’s-eye view of your app, without an attacker.
- 01
Paste your repo
Drop in your GitHub link. Add your live URL and database key for a deeper look — both optional, both read-only.
- 02
We read it like an attacker
Twenty-two checks across your whole code history and your live site, then a review pass that throws out the false alarms.
- 03
Read it in plain English
A grade, and every finding with what could happen and the exact fix. No security background required.
What comes back
A grade with the arithmetic shown, every confirmed finding in plain English, and an honest list of what could not be reached.
Run my free scanscore 62 / 100 · commit 8f3a1c2
Capped at C: one confirmed critical. The gate is in the scoring, not in our opinion.
Your live site and database were not supplied, so the header, cookie and database-permission checks did not run. They are not passes, and they are not counted as findings. Add a URL and they run next time.
- CriticalA password to your database is sitting in your code history
- HighA server key is shipping to every visitor's browser
- MediumSign-in has no limit on guessing attempts
Illustrative. Your report is generated from your own code.
Finding it is free
Fixing it is the job.
The free scan
$0
- All twenty-two checks, your whole git history
- Your A–F grade and every issue count
- Your worst finding, explained in full
- A badge for your README
The full report
$35 once
- Every issue, not just the first
- Exact fix instructions for each
- JSON and SARIF export for your tooling
- Option to book a fix call
Keep it clean
Coming soon
- Every check re-run, every week
- An email only when something opens
- Each re-scan unlocked in full
Before you paste anything
Is my code safe with you?
We only read it. Nothing is ever written back. If you hand us a token for a private repo it must be read-only, it is stored encrypted, it never reaches a log, and we delete it whenever you ask.
Do I need to be technical?
No. Every finding is written in plain English with a concrete example of what could go wrong. There is a separate technical section your developer — or an AI tool — can work from.
How long does it take?
A minute or two. You paste your GitHub link and watch it run.
What do I get for free?
Your grade, the counts, and one full critical finding written out. The full report is a one-time $35.
How is this different from a cheap scanner?
Most of them hand a developer a wall of jargon. This is built for the person who paid for the app: a real grade, a plain-English scenario for every hole, and the exact fix. And when a check could not run, it says so instead of counting it as a pass.