Find and prevent secrets and prompt injection attacks in AI coding agent sessions
Stage
Startup
Not given
Founded
Not given
Not given
Based in
US
Not given
Pricing model
Freemium
Open source
Pricing
Free scan: $0. Fix Pack: $29 one-time (includes one deep scan and 2 re-scans for one app, plus 30 days of monitoring). Stay Locked: $15/mo (includes unlimited re-scans of one app, independent scan on every deploy, automatic daily re-scan). DIY playbook: $9 ebook.
Not given
Key features
Scans for leaked API keys and secrets from major providers
Detects exposed .env and .git files
Checks security headers and missing protections
Detects Supabase and Firebase backends
Copy-paste fix prompts for every finding
Ownership-verified deep scan with RLS testing
Automatic deployment scanning and grade monitoring
Passive and read-only scanning
Scans up to 20 JavaScript bundles and source maps
Integration with AI assistants via Model Context Protocol
Scan recorded AI agent sessions for known credentials
Guard against prompt injection attacks
Local console with audit trails at 127.0.0.1
Support for multiple AI coding agents including Claude Code, Cursor, and Codex CLI
Default policy with 21 rules across 19 action classes
Test policy against replayed attack scenarios
No model or network in the guard's hot path
What makes it different
Specifically designed for AI-generated apps from Lovable, Bolt, Replit, Cursor and v0
Free scan with no signup required
Copy-paste fix prompts tailored to your AI builder
Re-scanning to prove fixes work
Automated alerts when security grade drops on deployment
Deterministic policy-based enforcement rather than model-based decisions
Runs locally with no telemetry and no account required
Open source and free forever under Apache-2.0
Replayed 36 real attack scenarios with zero bypasses
ShipLatch
Stroq