Your AI says your app is secure. It says that every time.

How it works

What a finding looks like

No CVE jargon — what went wrong, and the exact fix prompt your AI tool can apply. All four run in the free scan, and the prompts below are the real ones from our catalog — try copying one.

A security scan found hardcoded secrets in this project. Fix them properly —
rotation first, then removal:

1. ROTATE FIRST: for each secret below, revoke + reissue it in the
   provider's console (OpenAI/Anthropic/Stripe/Resend/Twilio/AWS all have
   an API-keys page). Deleting the line does not invalidate the key.
2. In these locations, replace the hardcoded values with environment
   variable reads (`process.env.*` in server code only):
   {{locations}}
   Never reference these via NEXT_PUBLIC_* or VITE_* — those are bundled
   into the client and shipped to every visitor.
3. Put real values in `.env.local` (gitignored) and placeholders like
   `your-api-key-here` in `.env.example`.
4. Don't obfuscate the old value anywhere — treat it as public now.

When done, the re-scan's secret detection over the current files must
report zero matches.

A live scan of {{live_url}} found Supabase tables readable by anonymous
requests. Fix:

1. In Supabase: Authentication → Policies — enable Row Level Security on
   every exposed table.
2. In your migrations, add `ALTER TABLE <table> ENABLE ROW LEVEL
   SECURITY;` for each table plus policies scoped to the owner:
   `CREATE POLICY "own data" ON <table> FOR ALL USING (auth.uid() =
   user_id) WITH CHECK (auth.uid() = user_id);`
3. Guardrail: never use `USING (true)` — that keeps the table world-open.
   Anchor policies to `auth.uid()`.
4. Service-role/admin access stays server-side only.

Verification: the anonymous re-scan must return 0 rows or an RLS error.

A scan of {{live_url}} found an admin page open to unauthenticated
visitors. Fix:

1. Add a server-side auth + role gate to the admin route (or the layout
   that contains it), and to the APIs it uses.
2. The server must return 401/403 for unauthorized requests — blocking in
   the UI alone doesn't protect the data.

Verification: unauthenticated GET of the path returns 401/403/login
redirect on re-scan.

A live scan found `.git/` exposed at {{live_url}}. Fix:

1. Stop shipping `.git`: exclude it from the deploy artifact/build, and
   block `/.git*` at the proxy/CDN layer.
2. Clean-rebuild + redeploy (stale artifacts persist served).
3. Check sibling dotfiles while you're in the proxy config.

Verification: re-scan sees 404/403 on `/.git/config` and `/.git/HEAD`.

Seven branches, one plain-English page each — every check, why AI tools produce it, and how it's detected.

Free scan · Full Report $59 · Launch Pack $179 · Rescue $59 — one-time, 30-day refunds. GitHub CI: $19.99/mo per private repo.

Your code, handled carefully

• • Deleted after scan by default. Your code is wiped unless you opt into re-scan retention.
• • Encrypted retention, auto-expiring. Launch-Pack re-scan copies are AES-256-GCM encrypted and purged after 30 days.
• • Never store full secrets. Findings show only masked samples; we never keep raw credentials, response bodies, or raw IPs.
• • We never run your code. Probes are read-only (GET/HEAD/OPTIONS) and rate-limited. See our scan bot policy.

FAQ