For SaaS teams with no security person
Find the security holes in your SaaS, and get a fix for each one
Paste your URL for a free scan from the outside, the way an attacker sees your app, with no login or setup. Then add and verify your site, and we run deeper tests and send a pull request for each hole we confirm. You approve every fix.
Why we’re building it
You built fast with AI tools, and now you have paying users.
You don’t know if your app is leaking data.
A pentest costs $5k or more, and nobody on the team does security.
Meanwhile, attackers using AI find holes within days.
−7days
Average time-to-exploit in Google’s M-Trends 2026 report. Below zero means attackers used a hole before its fix was out.
Why now
Holes get used faster than they get fixed
- 141 exploited vulnerabilities in eight months Up from 127 in all of 2025.
- 95% ran software with a known vulnerability Most sites keep running old versions after a fix exists.
- Founders already pay $100–500 for an audit Many of them ask for fixes they can ship, and a scanner PDF doesn’t give them that.
The free scan reads what any visitor can see
No login, no setup and no permission needed, because it reads nothing your site doesn’t already show the world. We aim to have results in minutes.
A framework version with a known vulnerability
Spotted from the version your pages give away. Upgrading usually closes it.
Each finding says what it is and how to fix it
Results come back in plain words, sorted by how much each one matters, so you know where to start.
12checks run
2high
2medium
Anyone can see these on yourapp.com right now.
- High
A Supabase service key in the JS bundle
It skips your row-level security. Rotate it and keep it on the server.
- High
Source maps are public
Anyone can read your original code, including routes you never linked.
- Medium
No HSTS header
Browsers may reach your site over plain HTTP before switching to HTTPS.
- Medium
Session cookie without the Secure flag
It can travel over a connection that isn’t encrypted.
With your permission, we test deeper and send the fix
Sending test attacks needs the owner’s OK. So the deeper tests run on a site you’ve added and verified as yours, and never before.
-
Step 1
Add and verify your site.
- Shows us the site is yours
- No test attack runs before this
-
Step 2
We test it the way an attacker would.
- Data access and Supabase RLS
- IDOR, auth and injection
- Connect Supabase and GitHub if you want the full picture
-
Step 3
Get each fix as a pull request.
- One pull request per hole
- You approve every fix
-
Every deploy
Re-checked when you ship.
- On every deploy, not on a schedule
- A report you can share with your customers
How small SaaS teams check security today
Many small teams check nothing yet. Free passive scanners exist, like vibeward, VibeSafe and UNPWNED, and Lovable has one built in. We go further after the scan, with tests on your verified site, a fix you approve and a re-check on every deploy.
| Job | Built-in scansLovable, Supabase | Upwork auditFreelancer, one-off | Pentest firm$5k–30k a test | ScannersIntruder, Siemba, Stingrai | CalmcometScan, test and fix |
|---|---|---|---|---|---|
| Free scan from just your URL | Inside their platform | Varies | Yes, no login | ||
| Works on any stack | Yes | ||||
| Tests data access, IDOR and auth | Varies | Varies | Varies | On your verified site | |
| Sends a fix you can merge | Varies | Usually a report | A report | A report | A pull request you approve |
| Re-checks when you ship | Varies | One-off | One-off | On a schedule | Every deploy |
| Cost | Included | $100–500 | $5k–30k | Siemba $100/mo, Intruder $149/mo, Stingrai $650/mo | Free scan, testing price not set yet |
Early access
Free scan
Small SaaS teams
Built for SaaS teams that ship fast and have no security person.
- 1 to 20 people, a live product and paying users
- Supabase, Next.js, Vercel or Stripe, often built with Cursor, Lovable or Bolt
- No security hire and no SOC 2 yet
Common questions
What any visitor can see: your stack and any old, vulnerable versions, security headers like CSP and HSTS, TLS and cookie flags, API keys or source maps left in your public JS bundle, and endpoints or files anyone can reach. We aim to have results in minutes.
No. Paste your URL. The free scan needs no login, no code and no setup.
No. The free scan reads what your site already shows every visitor. Test attacks, like probing data access or logins, run on a site after its owner has added and verified it, and never on anyone else’s.
Data access and Supabase row-level security, IDOR, auth and injection, to confirm which holes are real. You can also connect Supabase and GitHub for the full picture. That part is optional.
For each hole on your verified site, you get a pull request with the fix. You review and approve it before anything changes.
Yes. It works on any stack. Lovable and Supabase have their own built-in scans, and those stay inside their platforms.
They do, like vibeward, VibeSafe and UNPWNED, and Lovable has one built in. The scan is the start. After it, we test your verified site, send a fix you approve, and re-check on every deploy.
Yes. You get a security report you can share with your own customers, so security helps you sell.
The free scan is free. We haven’t set the price for the deeper tests and fixes yet. Join the waitlist and you’ll hear it before you commit to anything.