Free scan: $0. Fix Pack: $29 one-time (includes one deep scan and 2 re-scans for one app, plus 30 days of monitoring). Stay Locked: $15/mo (includes unlimited re-scans of one app, independent scan on every deploy, automatic daily re-scan). DIY playbook: $9 ebook.
Open-source sensor is free. Enterprise pilot for up to 25 developer seats starts with a 90-day design-partner pilot, scoped with you.
Key features
Scans for leaked API keys and secrets from major providers
Detects exposed .env and .git files
Checks security headers and missing protections
Detects Supabase and Firebase backends
Copy-paste fix prompts for every finding
Ownership-verified deep scan with RLS testing
Automatic deployment scanning and grade monitoring
Passive and read-only scanning
Scans up to 20 JavaScript bundles and source maps
Integration with AI assistants via Model Context Protocol
Records tool calls from Claude Code, Cursor, Codex, GitHub Copilot and other agents
Detects risky sequences and agent behavior patterns
Forwards to SIEM: Splunk, Elastic, Microsoft Sentinel, Google SecOps
MCP server scanning to detect risky or malicious integrations
Works on Windows, Linux and macOS without kernel driver
DLP integration to prevent credential and sensitive data exfiltration
0 false positives across 57 test cases with MITRE ATT&CK coverage
What makes it different
Specifically designed for AI-generated apps from Lovable, Bolt, Replit, Cursor and v0
Free scan with no signup required
Copy-paste fix prompts tailored to your AI builder
Re-scanning to prove fixes work
Automated alerts when security grade drops on deployment
Hash-chained records can be verified offline, catching any tampering or editing attempts
Sees which AI agent ran the command and the session it belongs to, unlike EDR tools
No account required, no telemetry sent until you configure a sink
Single maintainer, self-funded, built in public with no hidden development
All claims on the website verifiable by running commands on your own machine
ShipLatch
Agentmetry