Your vibe-coded app might be leaking.
SniffPup sniffs it out.
Paste your Lovable, Bolt, Cursor, Replit or v0 app. In about 30 seconds we check for exposed API keys, public .env and .git files, missing security headers, and whether Google & ChatGPT can actually read your pages. Then we hand you copy-paste fix prompts.
How it works
1. Sniff 👃
We load your site like a normal visitor and read the JavaScript your app ships to every browser. That's where leaked keys hide.
2. Explain 🗣️
Each finding gets a severity and a plain-English explanation. No security degree needed.
3. Fix 🛠️
Copy a ready-made prompt for Lovable, Cursor, Bolt or Claude Code, paste it, redeploy, re-sniff.
What SniffPup checks
Supabase service_role keys, OpenAI, Anthropic, Stripe, AWS, GitHub and more. Always shown masked.
.env files, .git metadata, .npmrc, .DS_Store, public source maps.
HSTS, CSP, clickjacking protection, cookie flags, HTTP→HTTPS redirect.
What Googlebot and GPTBot actually receive vs. what your browser shows.
After you prove you own the site, a read-only check of which tables anonymous visitors can read. We count rows; we never download them.
Every deploy can re-open a hole. We re-check on a schedule and email you when something new appears.
Honest about what we do
- Free scans are passive: we only request what any browser could, plus a short list of well-known file paths.
- We never use keys we find, never try to log in, and never attack anything.
- Database checks only run on sites you've verified you own, and they're read-only.
- No scanner can promise your app is secure. SniffPup catches common, costly mistakes fast.