Scan any deployed app. 80+ modules: Supabase RLS probe, AI-key detection, XSS testing, GraphQL audit, Firebase deep probe, subdomain takeover, IDOR detection, AI code fingerprinting, OWASP compliance reports, and more. PDF reports, CI/CD webhooks, Slack/Discord alerts.
One MCP server, every AI coding tool.
You don't leave your AI assistant.
/security-scanThe skill detects your deployment URL from CLAUDE.md or .env, then triggers a scan via MCP.
Transport & headers, Supabase RLS probe, auth bypass on API endpoints, signup mass-assignment, payment webhook verification, SQL injection, SSTI, IDOR, GraphQL audit, AI-key leak detection, subdomain takeover, admin panel exposure, PII leak scanning, CORS / CSP / TLS / nuclei 8k+ CVE templates, and more.
Our AI writes a SECURITY-FIX.md with exact code changes for your tech stack. Claude Code reads it and implements fixes with your approval.
Organized into 7 categories. Full module-level walkthrough →
.from('table') + .rpc() from the JS bundle, probes each with the anon key for Row Level Security misconfigs.storage.from('bucket') refs, lists each — flags publicly listable buckets.functions.invoke() references.collection() names, probes each with Firebase apiKey/.json root for unauthenticated readNo exploitation. No destructive mutations. Read-only probes with bounded payload sizes. security.txt · What we don't do →
The questions we get most.
Not today. The scanner is a hosted product — the detection patterns are the product. We may release parts (the MCP server, the disclosure tooling) separately once the model stabilizes. In the meantime, every finding ships with exact detection methodology and a reproducible curl or SQL command so you can verify it yourself.
Yes — findings are stored per-user in your dashboard so you can track trend and re-check after a fix. Only you and your team members see them. We never publish individual results or share them with third parties. Delete a target and its scans go with it.
Only if you have authorization. Our Terms require you to own or have explicit permission to scan any target you submit. We do only read-only, non-destructive probes — but running an unauthorized scan can still violate local laws and the target's ToS. If you find something on someone else's app, please disclose responsibly.
Snyk scans dependencies in your repo. Burp is an interactive proxy you drive by hand. Cobalt is a human pentest engagement. We scan the live, deployed URL — what an attacker actually sees — and emit fix instructions formatted for your AI coding assistant to execute. Built for the developer who ships on Lovable / Replit / Bolt and wants a security pass in 3 minutes, not a 2-week engagement.
Free runs every detection module and shows you every finding, once. Paid plans add ongoing monitoring (weekly / daily re-scans), email alerts when a new CRIT appears, multi-target tracking, priority queue, API access for CI/CD, and the AI-generated SECURITY-FIX.md file your assistant can execute.