Meet Ember

Ember is a very real, very fluffy black Pomeranian and our Chief Sniffing Officer. She's small, curious, and she notices everything: a new smell on the walk, a dropped snack, a door left open.

That's the job we built SniffPup to do for your app. It checks the things AI builders commonly leave lying around (API keys in your JavaScript, public .env or .git files, missing security headers) and tells you in plain English how to fix them.

Ember doesn't write the code. She supervises from the couch, and she approved the pink checkerboard.

About the SniffPup scanner

If you saw SniffPupScanner in your logs, someone asked SniffPup to check a site. Here's exactly what it does:

• Loads the page and the same-origin JavaScript files it references, like a normal browser.
• Requests a short, fixed list of well-known paths (for example /.env, /.git/config, /robots.txt, /llms.txt).
• Roughly 40 requests or fewer per scan, with rate limits per target site.
• No login attempts, no fuzzing, no exploit payloads, and it never uses keys it finds. Any secret it spots is masked in the report.
• Database checks only run against sites whose owner verified ownership via DNS or a file, and they are read-only (row counts only).

What it can't promise

A passive scan finds common, costly mistakes quickly. It is not a penetration test or a code audit, and a clean result doesn't mean your app is secure. Think of Ember as a good first line of defense, not the last one.

To opt your site out or report abuse, email abuse@sniffpup.com (mailbox to be set up before launch).