SniffPupSniffPup FAQ
The case file on SniffPup. Ember sniffs the outside of your live web app, the parts any stranger can see, and tells you what she found in plain English. Here's what she checks, what she can't see, and what it costs.
What SniffPup is
What is SniffPup?
SniffPup is a passive security scanner for web apps built with AI tools such as Lovable, Bolt, Cursor, Replit and v0. You enter your live URL and Ember, our detective Pomeranian, checks what that site shows to any visitor: leaked keys, public files, a public source map, missing security headers and more.
What does "passive" mean?
SniffPup only fetches what your site already serves to the public, the way a browser would. It does not log in, fuzz, send exploit payloads, or use any secret key it finds. A free scan makes around 40 requests or fewer and is rate-limited per target site. What the scanner does and never does →
Can SniffPup scan my mobile app?
No. SniffPup scans live web URLs only. It can't scan native iOS or Android apps. If your mobile app has a web version or a marketing site, SniffPup can scan that URL.
What the free scan checks
What does the free scan check?
Secrets in your HTML, inline scripts and same-origin JavaScript bundles (for example OpenAI, Anthropic, Stripe, AWS, GitHub and Slack keys, private key blocks, database connection strings, and Supabase service_role and sb_secret keys), masked in the report. Public /.env files (variable names only are reported), /.git/config, /.git/HEAD, /.DS_Store and /.npmrc. The source map your JavaScript points to. Security headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), cookie flags and the HTTP to HTTPS redirect. And what AI crawlers can read: raw HTML for a browser vs GPTBot, robots.txt AI-crawler blocks, llms.txt, title, meta description and h1.
Does it check .map files for every script?
No. It checks the one source map your JavaScript bundle references, not a .map URL for every file.
What do I see for free?
The free scan lists every issue it finds by title and severity, and shows the full explanation, evidence and fix for the most serious one. The one-time $19 Full Fix Report unlocks the explanation, evidence and copy-paste fix prompt (for Lovable, Cursor, Bolt or Claude Code) for every finding. See a sample report →
Supabase and what the free scan can't see
Can the free scan check my Supabase RLS policies?
No. The free scan can't see Row Level Security policies, because it never touches your database. When it finds your Supabase project URL in your HTML or JavaScript, it adds a note that your site talks to Supabase and whether the public anon or publishable key is there too (that key is meant to be public). If it finds no project URL, there is no Supabase note. It flags a service_role or sb_secret key in your frontend as critical, because those bypass RLS. How to check RLS yourself →
How does the Pro deep Supabase check work?
It is part of the Pro plan and runs only after you prove you own the site, with a DNS TXT record or a /.well-known file. It uses your site's public anon key, read-only. It lists the tables your API exposes and checks up to 30 of them (or tries common names like users, profiles and orders if that list isn't available), asking for a row count on each without downloading any rows. It reports tables an anonymous visitor can read, and lists storage buckets it can see that are marked public. It never inserts, updates or deletes anything and never stores row data.
Does a clean deep check mean my RLS is correct?
No. It tests anonymous reads only. It doesn't test writes, signed-in users reading each other's rows, or tables it can't find. Run Supabase's Security Advisor too and look for RLS Disabled in Public, Permissive RLS Policy and Security Definer View.
Does a clean SniffPup report mean my app is secure?
No. SniffPup checks what is publicly visible on your site. A clean report is not a guarantee of security. It can't see your source code, server logic, database policies or anything behind a login.
Pricing and refunds
How much does SniffPup cost?
The scan is free. The Full Fix Report is $19 one-time per app and includes 30 days of re-scans of that app. Plans: Solo $9/mo (1 app, weekly re-scan), Starter $19/mo (3 apps, weekly re-scans) and Pro $39/mo (10 apps, daily re-scans and the deep Supabase check). Yearly: $90, $190 and $390. Prices in USD; tax may be added at checkout. Pricing →
Can I cancel or get a refund?
Yes. You can cancel a subscription anytime from the billing portal; you keep access until the end of the current billing period. Email support@sniffpup.com within 7 days of any payment and we refund that charge in full, no questions asked. That covers monthly and yearly charges (including renewals) and the one-time Full Fix Report. Renewal charges made more than 7 days ago are non-refundable, except where required by law. Refunds go back to the original payment method through Stripe and usually appear in 5–10 business days. Refund policy →
Comparing tools? See how SniffPup compares with CheckVibe, ScanVibe, VibeDoctor, Lovable's security scan and Supabase Security Advisor.
A clean report is not a guarantee of security.