Your code never leaves this browser
Free · No signup · No upload · No server
AI-built apps have a small set of predictable security mistakes: keys left in the code, database tables nobody protected, leftover debug endpoints. Point this scanner at your project and it will tell you which ones you have, in plain English, with the exact prompt to paste into Cursor, Lovable or Bolt.
Drop your project folder here
Or use the buttons below. The files are read with the browser's own file API and analysed on this machine - nothing is uploaded, and the page never talks to any server.
Live Stripe keys, Supabase service-role tokens, AWS keys, Slack and Discord webhooks, private keys and hard-coded assignments to anything named SECRET, TOKEN, PASSWORD or API_KEY. Values are redacted - the report never shows a working key.
Postgres tables created without Row Level Security, permissive USING (true) policies, and
SECURITY DEFINER functions with no pinned search_path.
JWT verification that accepts alg: "none", tokens that are decoded instead of verified, and
signing secrets that fall back to a hard-coded default.
Wildcard CORS combined with credentials, reflected origins, leftover /api/debug style routes
and source maps published with the build.
A tool that runs in your browser stops where your folder stops. The report is explicit about the gaps: it never tests your live site, never runs a dependency audit, and cannot read your git history. The full paid review covers all of those.