A security check for apps made with AI builders

Your app might be leaking keys. Let Ember sniff it first.

Paste your URL. In about 30 seconds we check for leaked API keys, public .env and .git files and missing security headers, with a fix to paste into your AI builder.

Free. No signup. Read-only: we only look at what any visitor can see.

Built with Lovable, Bolt, Cursor, Replit, v0 or Supabase? Scan it.

Works on any public http(s) website, whatever made it. We're not affiliated with these companies.

How it works

  1. Paste your link

    We load your site the way a visitor's browser does and read the JavaScript it sends. That's where leaked keys usually hide.

  2. See what's wrong

    Every issue gets a severity and a short explanation in normal words. You don't need to know security jargon.

  3. Paste the fix

    Copy a prompt made for Lovable, Cursor, Bolt or Claude Code, let your builder fix it, redeploy, and scan again.

What Ember checks

The free scan covers the mistakes we see most in AI-built apps. All of it comes from the outside, the same way a stranger would look.

Cartoon Ember, a black Pomeranian in a detective hat, peering through a magnifying glass
Leaked keys in your JavaScript
Supabase service_role and secret keys, OpenAI, Anthropic, Stripe, AWS, GitHub and more. Always masked in the report.
Public files and outdated libraries
.env files, .git metadata, .npmrc, .DS_Store, the source map your JavaScript points to, and old JavaScript libraries with known vulnerabilities.
Security headers and HTTPS
HSTS, CSP, clickjacking protection, cookie flags, the HTTP to HTTPS redirect, and whether your HTTPS certificate is valid and when it expires.
What crawlers see
What GPTBot gets compared with your browser, plus robots.txt and llms.txt.
Your Supabase tables Pro
After you prove you own the site, a read-only check of which tables a stranger can read. We count rows. We never download them.
Re-scans and alerts Plans
Every deploy can open a new hole. We re-check on a schedule, email you when a new serious issue shows up, and keep your last 20 scans per app so you can see what changed.

What we can't check

We'd rather you know this up front.

  • Only your public URL. We can't scan native iOS or Android apps, or anything that isn't a public http(s) site.
  • Nothing behind a login. We never sign in, so pages and APIs that need an account stay unchecked.
  • No source code. We don't see your repo, your server code or your git history, only what your site sends to browsers.
  • The free scan can't see your database rules. It can't read your Supabase RLS policies. The Pro check only tests what an anonymous visitor can read.
  • No attacks. It's passive: no fuzzing, no exploit payloads, no login attempts. So it is not a penetration test.
  • Not a guarantee. A clean report means we didn't find anything in the checks we run. It doesn't mean your app is secure.

More in the FAQ · Exactly what the scanner does

Ember, a fluffy black Pomeranian in a pink checkered harness, sitting on the grass in a park

Yes, Ember is a real dog

She's a small, very fluffy black Pomeranian, and she notices everything: a new smell on the walk, a dropped snack, a door left open.

That's the job we built SniffPup to do for your app. AI builders are great at shipping fast, and they sometimes leave a key in the JavaScript or a .env file on the server. We find those before someone else does.

Ember doesn't write the code. She supervises from the couch.

What it costs

The scan is free: see every issue it finds, with full fixes free for every critical issue (with no critical, one other fix is free). Pay $9 once to get the fix for every issue plus 30 days of re-scans. Or keep an eye on things from $7/mo.

See pricing See a sample report

Questions people ask

Is it safe to scan my app?

Yes. Free scans are passive. SniffPup loads your page and the JavaScript it ships, like a normal browser, plus a short fixed list of well-known paths such as /.env and /.git/config. It never logs in, never sends attack payloads and never uses a secret key it finds. Full scanner details.

Do you store the secrets you find?

No. We store findings with secrets masked, never the full value. For Pro database checks we store only whether a table or bucket is readable and its row count, never row contents. See the Privacy Policy.

What do I get for $9?

Every finding for one app, with a plain-English explanation and a copy-paste fix prompt for Lovable, Cursor, Bolt and Claude Code, plus 30 days of free re-scans so you can check your fixes. You pay once. No account, no subscription.

Can I cancel or get a refund?

You can cancel a subscription anytime from the billing portal; it ends at the end of the billing period. All sales are final, except where required by law or if we charged you in error. Here's the refund policy.

Does a clean result mean my app is secure?

No scanner can promise that. A passive scan catches common, costly mistakes quickly. It is not a penetration test or a code audit.

Someone scanned my site. How do I opt out?

Email abuse@sniffpup.com with your domain and we'll block scans of it. More about the SniffPupScanner bot.

Guides and free checkers