A security check for apps made with AI builders
SniffPup scans vibe-coded apps. Let Ember sniff it first.
Free security scanner for Lovable, Bolt and Cursor apps.
Taking payments with Stripe? Check your Stripe code free →
15 checks per scan
Leaked keys, exposed files, headers, HTTPS, CORS, database exposure and email setup.
Learn more →Passive and read-only
We only look at what any visitor's browser can see. Secrets we find are always masked.
Learn more →Fix prompts for your AI builder
Copy a prompt made for Lovable, Cursor, Bolt or Claude Code, then re-check.
Learn more →Check your code too
Repo scan for a public GitHub repo, and the Payments Doctor for your Stripe code.
Learn more →Built withLovableBoltCursorReplitv0Supabase· Scan it.
Works on any public http(s) website, whatever made it. We're not affiliated with these companies.
How it works
Find issues. Fix fast. Ship it.
Three steps, no security jargon.
Paste your link.
Drop in your live URL. We load it like a visitor would. No login, no code access needed.
See what's wrong.
Every issue gets a severity and a short explanation in normal words.
Critical Exposed OpenAI API keyMedium AI assistants see an empty pageLow Missing 4 security headersPaste the fix.
Copy a prompt made for Lovable, Cursor, Bolt or Claude Code, let it fix the issue, redeploy, and re-check.
Example report
What a report looks like
Example report · demo-app.example is a made-up site with fake keys, not a real customer
- critical Exposed Stripe live secret/restricted key
- critical Exposed OpenAI API key
- critical Exposed Supabase service_role key
Everything in one place
Everything SniffPup does
Every feature, one click away. The same list lives in the Features menu at the top of every page.
Start here
Sniff & Fix
Sniff & Fix hub
Paste-in checks for other common bugs in AI-built apps.
Open →Free quick checkPayments Doctor
Paste your Stripe checkout and webhook code. Quick check free; full check on Solo and up.
Open →Free quick checkRepo scan
Check a public GitHub repo for committed keys, .env files, tables without RLS and Stripe mistakes, plus a licence check and an SBOM of your npm packages.
Open →Free accountSupabase project check
Connect your Supabase project for a free, read-only check of its security settings. You get a score out of 100, and critical issues come with their fix.
Open →FreeMigration safety check
Paste a database migration, or scan a repo, to catch steps that delete or rewrite data before they run. It also flags migrations that run on deploy with no backup first, and the Supabase project check shows whether you have a backup to restore from.
Open →FreeSpeed Doctor
Part of every free scan: a speed score out of 100 and what slows your site down, like heavy JavaScript, large images and missing cache headers. Every finding is free; Solo and up get every fix step.
Open →FreeCrash Catcher
Part of every free scan: a crash score out of 100 and what can break your site for visitors, like scripts that fail to load and leave a blank page, crash screens, broken styles and dead links to your own pages. Verified sites can also add a small script to see crashes real visitors hit. Every finding is free; Solo and up get every fix step.
Open →FreeCleanup report
Part of the free repo scan: packages and files you likely don't use, copied code, very large files and errors that get hidden, with a cleanup score out of 100 and a step-by-step cleanup plan. Every finding is free; Solo and up get every fix step.
Open →FreeFree tools
Headers, public .env, source maps, Supabase keys and data, Firebase rules, RLS policy explainer.
Open →Your reports
Full fix report
Every fix with prompts for Lovable, Cursor, Bolt and Claude Code, plus 30 days of re-scans.
Open →Full reportsAI rules file (Guardrails)
Turns your findings into a rules file for Cursor, Claude Code, Lovable or Bolt, so your AI helper is told not to repeat them. In the full fix report.
Open →On unlocked findingsRe-check one finding
Fixed something? Re-check just that finding in one click.
Open →Full reportsPDF and Markdown export
Download any full report.
Open →Free accountDashboard and projects
Every scan, score trends and before/after history.
Open →PlansScheduled re-scans
Weekly on Free, daily on Solo, and every hour on Starter, Pro and Ultimate for sites you've verified, with an email only when something new and serious shows up or gets worse.
Open →For verified owners
Verify your site
DNS TXT record or a file. Unlocks the Pro deep checks.
Open →ProDeep Supabase and Firebase check
Read-only: which tables, collections and buckets a stranger can read. Counts only.
Open →ProCombined Supabase report
Advisor + outside scan + deep check + fix prompts in one report.
Open →Verified ownersScore badge
Score 80+? Show a badge and public score page. Score and date only.
Open →Learn
All checks
Every check SniffPup runs, in one list.
Open →Guides
Pre-launch checklists for Lovable, Bolt, Cursor, Replit and Supabase.
Open →Leaked a key?
What to do in the next 10 minutes: OpenAI, Stripe, Supabase, AWS, GitHub.
Open →Changelog
Everything we shipped, newest first.
Open →Compare scanners
What we check and what others check. Facts only.
Open →What the free scan checks
15 checks, all from the outside
The same way a stranger would look. You can watch each one run live when you scan.
- Loading your page like a visitor's browserOne GET of the URL you entered, following redirects
- Looking for leaked keys in the page and inline scriptsOpenAI, Anthropic, Stripe, Supabase, AWS, GitHub, Slack, Resend and more
- Reading your JavaScript files for keys and old librariesUp to 20 same-site JS files, plus the chunks they load
- Checking for a public source mapIs your original source code downloadable?
- Checking for exposed files.env, .git, .npmrc, cloud credentials, SQL dumps, backups
- Checking security headers, cookies and the HTTPS redirectHSTS, CSP, clickjacking, cookie flags, http → https
- Checking your HTTPS certificateExpiry, issuer, name match, trust
- Comparing what GPTBot sees with your browserPlus robots.txt and llms.txt
- Checking AI crawler access and structured dataGPTBot, ClaudeBot, PerplexityBot, llms.txt links
- Spotting a Supabase or Firebase backendFrom the public config your site already ships
- Testing what a stranger can read from your databasePublic key only, read-only, no row data downloaded
- Checking CORSCan any website read your pages as your users?
- Checking your email setupSPF, DMARC and DKIM, DNS lookups only, no mail sent
- Checking speed and accessibility basicsResponse time, compression, page and image size, alt text, labels, language
- Checking your domain, outside scripts and legal linksDomain expiry from the public registry, http:// files, outside script hosts, privacy and terms links
We'd rather you know this up front
What we can't check
Yes, Ember is a real dog
Meet our Chief Sniffing Officer
She's a small, very fluffy black Pomeranian, and she notices everything: a new smell on the walk, a dropped snack, a door left open.
That's the job we built SniffPup to do for your app. AI builders are great at shipping fast, and they sometimes leave a key in the JavaScript or a .env file on the server. We find those before someone else does.
Ember doesn't write the code. She supervises from the couch.
Read Ember's story →What it costs
Start free. Pay only for the fixes you want.
See every issue. Full fixes free for every critical issue (no critical? one other fix is free).
Scan freeFull fix report
Every fix for one app, plus 30 days of free re-scans. No account, no subscription.
See the reportPlans
Solo $7, Starter $15, Pro $29, Ultimate $49. Daily or hourly re-scans and alerts.
Compare plansFAQ
Questions people ask
Is it safe to scan my app?
Yes. Free scans are passive. SniffPup loads your page and the JavaScript it ships, like a normal browser, plus a short fixed list of well-known paths such as /.env and /.git/config. It never logs in, never sends attack payloads and never uses a secret key it finds. Full scanner details.
Do you store the secrets you find?
No. We store findings with secrets masked, never the full value. For Pro database checks we store only whether a table or bucket is readable and its row count, never row contents. See the Privacy Policy.
What do I get for $9?
Every finding for one app, with a plain-English explanation and a copy-paste fix prompt for Lovable, Cursor, Bolt and Claude Code, plus 30 days of free re-scans so you can check your fixes. You pay once. No account, no subscription.
Can I cancel or get a refund?
You can cancel a subscription bought on our website anytime from the billing portal; it ends at the end of the billing period. Purchases made in our app are cancelled and refunded through the store you paid. All sales are final, except where required by law or if we charged you in error. Here's the refund policy.
Does a clean result mean my app is secure?
No scanner can promise that. A passive scan catches common, costly mistakes quickly. It is not a penetration test or a code audit.
Someone scanned my site. How do I opt out?
Email abuse@sniffpup.com with your domain and we'll block scans of it. More about the SniffPupScanner bot.
Guides and free checkers
- Best free security scanners for vibe-coded apps (2026)
- Lovable app security scanner for your live URL · Is my Lovable app secure?
- Bolt app security scanner · Bolt app security check: is my Bolt app secure?
- Free Supabase exposed data checker · Supabase RLS checker guide
- Is your .env public? Free .env exposure checker · Find exposed API keys on your website
- How SniffPup compares with other scanners · All free checkers · All guides