SECURITY FOR WHAT YOU BUILD WITH AI
Find the leaks
before your users do.
We find exposed keys, open database policies, and broken auth in your AI-built app. Get a clear report and a practical path to fixing them.
Free: check if your app is leaking secret keys →
YOUR TOOLS.
OUR TERRITORY.
Works with Lovable, Bolt, v0, Replit, Windsurf, Cursor, Claude Code, Codex on Next.js, React, and Supabase.
00 / THE PROBLEM
These mistakes don't break anything, so you won't see them while clicking around your own app.
of 200 audited live Claude Code and Lovable apps had at least one vulnerability.
of the 1,186 vulnerabilities found were Critical or High, mostly broken access control, injection, and auth.
01 / THE EVIDENCE
This is output from our real pipeline on a deliberately vulnerable demo app. Every finding has a severity, supporting evidence, and a next step.
We built lockedvibe-vulnerable-demo, a small Next.js + Supabase app with planted mistakes, and ran our real scan pipeline on it (commit 096e54df4b95, October 14, 2026). 16 findings: 5 critical, 6 high, 4 medium, 1 low.
Automated evidence checks; no human review of each finding. No live systems contacted.
Privileged credentials in a browser-bundled file.
Anonymous access reproduced in a throwaway database.
No visible authorization on GET and DELETE handlers.
Two findings remain after the demo fixes. They need a planned major framework upgrade.
The report keeps unresolved issues visible. A patched demo is not a security guarantee.
02 / CHOOSE YOUR DEPTH
One repo, one app. Read-only access is enough to scan. Audits run asynchronously after you order; this is not an instant scanner.
Know what needs attention.
Get the evidence and the next steps.
↗ Target: within 48 hours
Order your auditFull refund if we find nothing actionable. What the $99 covers →
Move from a list of findings
to changes you can review.
↗ Target: within 72 hours
Get the audit + fixesPR or patch, checked with build, tests & re-scan.
Give your release a deeper review,
from first audit to final re-scan.
↗ Target: within 5 business days
Book Launch LockdownYou review and approve every merge.
After checkout you'll fill in a 2-minute intake form (repo or zip, your app URL (we use it for Quick Review, and for our records otherwise), how to grant read-only access). Then we start the scan.
Founding price: the first 5 Scan + Report customers pay $49 instead of $99, in return for an anonymized case study. Details on the scan page.
Not ready for a full scan? The $29 Quick Review looks at your live app only and tells you what to fix first.
JS/TS apps up to about 50K source lines. Larger codebase? Ask for a quote ↗
EU/UK consumers: by checking out you ask us to start right away, and you acknowledge that your 14-day right of withdrawal ends once the service is fully performed (report delivered). Read the terms ↗
A re-scan of your default branch every 30 days, with a report email showing which findings are new and which are resolved.
Monitor isn't open for purchase yet. Join the waitlist and we'll email you once when it opens.
03 / THE HANDOFF
Most scans are back within 48 hours.
A 2-minute form: repo or zip, your app URL (we use it for Quick Review, and for our records otherwise), and confirmation that you own the app.
gitleaks, semgrep, osv-scanner, npm audit and Supabase RLS checks. In Scan + Report, each finding is marked confirmed (proven by an automated check; for dependencies, the vulnerable version is present; reachability isn't shown) or probable.
Findings ranked by severity. On Fix tiers, a PR you review and merge.
You can remove our access at any time; we ask you to once your report is delivered. We'll delete your code on request. Your report, which can quote short code excerpts with detected secrets masked, is kept up to 2 years unless you ask us to delete it sooner. The Lockdown Pack rules stay in your repo.
A BETTER START, FOR FREE
The free Lockdown Pack: a security .cursorrules, a CLAUDE.md, and a Lovable/Supabase pre-launch checklist, so your AI stops writing the holes in the first place.
You get the pack either way. Marketing emails only if you tick the box; unsubscribe anytime. See our Terms and Privacy Policy.
Or explore the security guides ↗BETTER DEFAULTS. FROM THE START.
A read-only deploy key (best for scan-only: we send you a public key, you add it to the one repo, no secret changes hands) or, for a repo owned by a GitHub organization, a collaborator invite with the Read role. Write access is only needed if you buy fix PRs. On a personal GitHub repo, a collaborator invite always grants write access, so we don't ask for one for scan-only work. We never need your service-role key unless you choose to share it, and you should rotate it afterwards.
We'll delete your code on request. Your report, which can quote short code excerpts with detected secrets masked, is kept up to 2 years unless you ask us to delete it sooner. We work on it in a private, temporary working directory. You can remove our access at any time; we ask you to once your report is delivered. We keep your intake details for up to 2 years so we can answer follow-ups and re-scans, plus job status logs that record progress and short error messages, which can include fragments of tool output. Ask and we'll delete them. Details on our Security and Privacy pages.
See our sample report, generated by our real pipeline against a deliberately vulnerable demo app, with before/after fix evidence.
Start with the free Leak Checker. It reads your live URL for exposed keys, public source maps and missing security headers. The $29 Quick Review turns that into your top 3 issues with a fix for each, within 1 business day, with no repo access. The $99 Scan + Report also analyzes your code with automated tools, so it covers Supabase RLS, server-side auth and dependencies, usually within 48 hours. If you want the fixes as a pull request, see Scan + Fix PR and Launch Lockdown in pricing.
Yes. Our free guides explain common Supabase Security Advisor findings and how to fix them: Security Definer View, Function Search Path Mutable, Leaked Password Protection Disabled and RLS Policy Always True. If inserts or uploads fail with "new row violates row-level security policy", see our guides for table inserts and Storage uploads. There are also guides on Firebase API keys, Clerk API routes, Stripe webhooks and exposed .env files. See all security guides.
No. It's a best-effort automated review of your code and configuration, with no human review of each finding. Findings are marked confirmed when an automated check proved them (for dependencies, the vulnerable version is present; reachability isn't shown) and probable otherwise. It's not a penetration test. It doesn't certify compliance (SOC 2, HIPAA, PCI) or guarantee zero vulnerabilities.
JS/TS (Next.js, React/Vite, Node) with Supabase, which is what Lovable, Bolt, v0, Replit, Windsurf, Cursor, Claude Code, and Codex produce by default. Ask about others.
Up to about 50K lines (excluding lockfiles and generated code). Bigger repos get a quote first.
Fixes are small, one per commit, and we run your build and tests. Nothing merges until you review and approve the PR.
BUILT SOMETHING GOOD?
$99 FIXED PRICE · Target: within 48 hours · READ-ONLY ACCESS