free security scan · built for AI-generated code
Cursor wrote your code.
Did it also leak your API keys?
Free security scan for AI-generated repos. Powered by industry-standard static analysis tools, explained by AI. Results in ~30 seconds.
or try a demo repo:
This is what you get back
Real findings, plain-English fixes. Here's a report from a typical AI-generated SaaS starter.
github.com/demo/ai-saas-starter · 27.4sExample report
2▲ critical
3▲ high
5◆ medium
0● low
commit
3e9d127 · 10 findings▲CRITICALgitleakssupabase_key_exposed_in_client_bundle
dist/assets/index-c4a81f.js:1
createClient("https://xyzcompany.supabase.co",
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIn0…")What's wrong:
A Supabase key with the service_role claim is shipped inside your client JavaScript bundle. Unlike the anon key, this one bypasses Row Level Security entirely — anyone who opens DevTools can read and write your whole database.
How to fix it:
Rotate the key in Supabase → Settings → API. Use the service-role key only in server-side code, referenced via an environment variable that never gets bundled into the client.
▲CRITICALsemgrepsql_injection_in_api_route
app/api/orders/route.ts:18
const orders = await db.query(
`SELECT * FROM orders WHERE user_id = ${searchParams.get("uid")}`
);▲HIGHgitleakshardcoded_jwt_secret
lib/auth.ts:7
const JWT_SECRET = "super-secret-change-me-later";+ 7 more findings in the full report
How it works
- 01
Paste a repo URL
Any public GitHub repository. No signup, no OAuth, no access to your account.
- 02
Real engines scan it
We run Semgrep and Gitleaks — the same tools security teams use — against your code and git history.
- 03
Get fixes in plain English
Every finding comes with an AI explanation: what's wrong, how to fix it, why it matters.
Trust
—repos scanned
—findings explained
0repos stored — ever
Built by Joris, CS student at TUHH Hamburg · GitHub ↗ · LinkedIn ↗
Private repo? Deployed app?
Private repo scanning and URL scanning are coming next. Leave your email and you'll be first in line.