# SniffPup

> SniffPup is a passive security scanner for web apps built with AI tools such as Lovable, Bolt, Cursor, Replit and v0. You enter a URL and SniffPup checks what is publicly visible on that site. It does not log in, fuzz, send exploit payloads, or use any secret keys it finds. The only key it ever sends is the site's public Supabase anon key, read-only, in the optional Pro deep check after the owner verifies the domain. A clean report is not a guarantee of security. SniffPup scans live web URLs only; it does not scan native iOS or Android apps.

## What the score means
- A score of 100 means no issues were found in SniffPup's checks. It is not proof that an app is secure: SniffPup cannot see source code, server logic, database policies or anything behind a login.

## Quick answers
- How do I check if my Lovable app is secure? Run Lovable's own Quick and Deep security scans inside your project, run Supabase Security Advisor on your database, then run a free SniffPup scan of the published URL to see what any visitor can see (leaked keys in JavaScript, public .env files, source maps, headers). Guide: https://sniffpup.com/guides/is-my-lovable-app-secure
- Is there a free tool to check if my Lovable or Supabase app is leaking API keys? Yes: SniffPup's free scan checks the live site's HTML and same-origin JavaScript for secret keys, including Supabase service_role and sb_secret keys, and masks them in the report. https://sniffpup.com/tools/supabase-key-leak-checker
- Supabase security scanner: Supabase Security Advisor checks your database from the inside (for example RLS disabled on public tables). SniffPup checks the live website from the outside, passively, including anonymous read access with the site's public config. Use both.

## Who runs it
- SniffPup (https://sniffpup.com) is a product of Ember and Saru LLC, a small, independent North Carolina company. Support: support@sniffpup.com

## How SniffPup differs from repo scanners and Supabase Security Advisor
- Gitleaks finds secrets such as passwords, API keys and tokens in git repos and files.
- TruffleHog finds secrets in Git and many other places, classifies over 800 secret types, and can check whether a found secret is still live.
- GitHub secret scanning scans a repository's entire Git history for hardcoded credentials; it runs automatically for free on public repositories.
- Supabase Security Advisor checks your Supabase project's database from the dashboard (and the CLI), for example public tables with RLS disabled.
- SniffPup checks the live, deployed app from the outside, passively and read-only, the way any visitor's browser sees it: keys built into JavaScript, public .env files and source maps, security headers. These tools work well together: scan the repo, check the database, and check the live site.

## What the free scan checks
- Secrets in HTML, inline scripts and same-origin JavaScript bundles (e.g. OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, SendGrid, Resend, Groq, xAI, OpenRouter, Replicate keys, private key blocks, database connection strings, Supabase service_role and secret keys). Found secrets are masked in the report.
- Sensitive paths: /.env files (variable names only are reported), /.git/config, /.git/HEAD, /.DS_Store, /.npmrc
- Public JavaScript source maps (checks the source map referenced by your JavaScript bundles)
- Security headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy), cookie flags, HTTP to HTTPS redirect
- HTTPS certificate (one TLS handshake on port 443): days until expiry (medium under 30 days, critical under 7 days or expired), plus issuer, hostname match (SAN) and browser trust. Free scan shows valid/expired and days left; the $9 Full Fix Report adds issuer, name check and fix steps; subscriptions email a warning at 30 days and again at 7 days/expiry. TLS 1.0/1.1 support is not tested.
- Outdated JavaScript libraries with known vulnerabilities (old jQuery, lodash, AngularJS and 60+ more), reported only when we can read the exact version; the free scan shows the worst one in full and the Full Fix Report lists them all.
- Crawler view: what a browser vs GPTBot sees in raw HTML, robots.txt AI-crawler blocks, llms.txt, title/meta description/h1
- Around 45 requests or fewer to the site per scan, rate-limited per target site. If the site uses Supabase or Firebase, up to 15 more read-only requests to that project using only its public config (GET/HEAD, no writes, no row data), plus DNS lookups for SPF/DMARC/DKIM.
- Free checks also include Supabase RLS and Firebase rules exposure (anonymous read access, shown in full on the free scan), email setup (SPF, DMARC, DKIM on common selectors) and CORS (reflected Origin).
- The free scan lists every issue found (title and severity) and gives the full fix (explanation, evidence and fix prompt) for every Critical issue free; if there are no Critical issues, one other fix is free. The one-time $9 Full Fix Report unlocks the plain-English explanation, evidence and copy-paste fix prompt (Lovable, Cursor, Bolt, Claude Code) for every finding.
- Accounts keep a before-and-after scan history: the last 20 scans per app on every plan (score trend, fixed and new since the last scan).
- Scans live web URLs only; it cannot scan native mobile apps.
- The free scan cannot see Supabase Row Level Security policies; it never queries your database. It reports when a site uses Supabase, whether the public anon/publishable key is present, and flags service_role or sb_secret keys in the frontend as critical.

## Paid options
- Full Fix Report: $9 one-time per app, includes 30 days of re-scans of that app and a free first month of Solo if you opt in
- Solo $7/mo (1 app, weekly re-scan), Starter $15/mo (3 apps, weekly re-scans), Pro $29/mo (10 apps, daily re-scans + deep Supabase check). Yearly plans: 2 months free.
- Pro deep Supabase check: only after the site owner verifies the domain (DNS TXT record or /.well-known file). Read-only, using the site's public anon key: checks up to 30 exposed tables, per-table row counts only (never row data) and storage bucket public flags.

## Refunds
- All sales are final, except where required by law or if we charged you in error. Subscriptions can be cancelled anytime from the billing portal; cancelling takes effect at the end of the current billing period. The free first month of Solo can be cancelled before day 31 at no charge. Purchases made before Oct 21, 2026 keep the refund terms they were sold under. See https://sniffpup.com/legal/refunds

## Pages
- [Home / free scan](https://sniffpup.com/)
- [Pricing](https://sniffpup.com/pricing)
- [What the scanner does and never does](https://sniffpup.com/scanner)
- [FAQ: what SniffPup checks, what it can't see, pricing and refunds](https://sniffpup.com/faq)
- [Compare: SniffPup vs CheckVibe, ScanVibe, SafeToShip, VibeDoctor, paste-your-SQL RLS checkers, Lovable's security scan and Supabase Security Advisor](https://sniffpup.com/compare)
- [Compare: SniffPup vs ScanVibe (two passive URL scanners; what each checks, free tiers, when ScanVibe is the better pick)](https://sniffpup.com/compare/sniffpup-vs-scanvibe)
- [Compare: SniffPup vs CheckVibe (quick outside scan vs full security platform for code, Supabase and pull requests)](https://sniffpup.com/compare/sniffpup-vs-checkvibe)
- [Compare: Supabase Security Advisor vs SniffPup (inside your database vs outside your website; why to run both)](https://sniffpup.com/compare/supabase-security-advisor-vs-sniffpup)
- [Sample report](https://sniffpup.com/sample-report)
- [How the 0-100 Sniff score works: start at 100, subtract 40 per critical, 20 per high, 8 per medium, 3 per low finding (info 0), clamp to 0-100; no letter grades](https://sniffpup.com/scoring)
- [The "Sniffed by SniffPup" badge: shows the scan date only (no score); the owner's own statement that they scanned on that date, not a certification, verification or guarantee; embed code is the badge image plus a visible text link to this page](https://sniffpup.com/badge)
- [Changelog: dated list of user-facing changes to SniffPup](https://sniffpup.com/changelog)
- [Status: live checks of the website, scan API and database, refreshed about every 60 seconds; no uptime percentages](https://sniffpup.com/status)
- [About](https://sniffpup.com/about)
- [Guides: all SniffPup security guides](https://sniffpup.com/guides)
- [Guide: Is my Lovable app secure? A pre-launch security checklist (Lovable's free Quick and Deep scans, signed-out anon-key test, RLS, secrets, Edge Functions, what the published site exposes)](https://sniffpup.com/guides/is-my-lovable-app-secure)
- [Guide: How to find exposed API keys on your website](https://sniffpup.com/guides/find-exposed-api-keys-on-your-website)
- [Guide: Supabase RLS checker (how to check Row Level Security on every table)](https://sniffpup.com/guides/supabase-rls-checker)
- [Guide: Best free security scanners for vibe-coded apps (2026): Lovable and Bolt built-in scans, Supabase Security Advisor, SafeToShip, Vibe App Scanner, Aikido and SniffPup; what each does well, verified prices, how to combine them](https://sniffpup.com/guides/best-free-security-scanners-for-vibe-coded-apps)
- [Guide: Bolt app security check: is my Bolt app secure? (Bolt's security audit and database check, VITE_ variables, RLS, what the published site exposes)](https://sniffpup.com/guides/is-my-bolt-app-secure)
- [Guide: Is my Cursor app secure? (.env and .cursorignore limits, NEXT_PUBLIC_ and VITE_ variables, Supabase RLS, Bugbot code review, what the live site exposes; compared fairly with Bugbot, ScanVibe and SafeToShip)](https://sniffpup.com/guides/is-my-cursor-app-secure)
- [Free checkers: each runs the normal free passive scan and explains one part of it](https://sniffpup.com/tools)
- [Free security headers checker (HSTS, Content-Security-Policy presence, X-Frame-Options/frame-ancestors, X-Content-Type-Options, Referrer-Policy, cookie flags, HTTPS redirect; page you enter only; does not grade CSP strictness)](https://sniffpup.com/tools/security-headers-checker)
- [Free .env file exposure checker (/.env, /.env.local, /.env.production, /.env.development, /.git/config, /.git/HEAD, /.npmrc, /.DS_Store at the site root; variable names only, never values)](https://sniffpup.com/tools/env-file-exposure-checker)
- [Free Supabase key leak checker (service_role and sb_secret_ keys in HTML and same-origin JavaScript; notes the public anon key as normal; does not test Row Level Security)](https://sniffpup.com/tools/supabase-key-leak-checker)
- [Free Supabase exposed data checker (leaked service_role/sb_secret_ keys, public .env files; free scan never queries the database; Pro owner-verified check counts which tables the public anon key can read, read-only)](https://sniffpup.com/tools/supabase-exposed-data-checker)
- [Lovable app security scanner for the live URL (outside, passive check of the published site; complements Lovable's Quick and Deep scans, which Lovable says "do not replace a thorough security review")](https://sniffpup.com/tools/lovable-app-security-scanner)
- [Bolt app security scanner for the live site (secret keys in VITE_ variables and bundles, public files, headers; complements Bolt's security audit)](https://sniffpup.com/tools/bolt-app-security-scanner)
- [Cursor app security scan for the live site (secret keys in NEXT_PUBLIC_ and VITE_ bundles, public files, source maps, headers; complements Cursor's ignore files and Bugbot code review)](https://sniffpup.com/tools/cursor-app-security-scanner)
- [Blog](https://sniffpup.com/blog)
- [Blog: Your Supabase "secret" key might be in your JavaScript](https://sniffpup.com/blog/supabase-service-role-key-in-javascript)
- [Blog: Is your Supabase table open to everyone?](https://sniffpup.com/blog/supabase-rls-using-true)
- [Blog: Can strangers read your app's source code? (public source maps)](https://sniffpup.com/blog/public-source-maps)
- [Refund policy](https://sniffpup.com/legal/refunds)
- [Acceptable use](https://sniffpup.com/legal/acceptable-use)