Security scanner for AI-generated code that catches secrets, CVEs, and OWASP vulnerabilities in under 30 seconds and auto-fixes with GitHub PRs
Stage
Startup
Not given
Founded
Not given
Not given
Based in
US
Not given
Pricing model
Freemium
Freemium
Pricing
Free scan: $0. Fix Pack: $29 one-time (includes one deep scan and 2 re-scans for one app, plus 30 days of monitoring). Stay Locked: $15/mo (includes unlimited re-scans of one app, independent scan on every deploy, automatic daily re-scan). DIY playbook: $9 ebook.
Free tier for public repositories with 3 scans per hour; paid plans available for private repositories and higher scan limits
Key features
Scans for leaked API keys and secrets from major providers
Detects exposed .env and .git files
Checks security headers and missing protections
Detects Supabase and Firebase backends
Copy-paste fix prompts for every finding
Ownership-verified deep scan with RLS testing
Automatic deployment scanning and grade monitoring
Passive and read-only scanning
Scans up to 20 JavaScript bundles and source maps
Integration with AI assistants via Model Context Protocol
Secret detection with 200+ credential patterns
CVE vulnerability scanning via OSV.dev
OWASP Top 10 coverage
Automated GitHub PR remediation
AI-powered fix explanations
Supply chain security analysis
API security scanning
CLI and CI/CD integration
Read-only ephemeral scanning
Scans complete in under 30 seconds
What makes it different
Specifically designed for AI-generated apps from Lovable, Bolt, Replit, Cursor and v0
Free scan with no signup required
Copy-paste fix prompts tailored to your AI builder
Re-scanning to prove fixes work
Automated alerts when security grade drops on deployment
Tuned detection rules for AI-generated code failure modes rather than generic vulnerability patterns
Specific vulnerability detection for each major AI coding tool including Copilot, Cursor, and Claude
Automated remediation with GitHub PR creation requiring no manual triage
Full scans in under 30 seconds with code never stored or used for training
Fills security gaps that existing tools like Snyk and Semgrep were not designed for
ShipLatch
ZenVeil