free security scan · built for AI-generated code

Cursor wrote your code.
Did it also leak your API keys?

Free security scan for AI-generated repos. Powered by industry-standard static analysis tools, explained by AI. Results in ~30 seconds.

no signup · public repos only · ~30 seconds

or try a demo repo:

This is what you get back

Real findings, plain-English fixes. Here's a report from a typical AI-generated SaaS starter.

github.com/demo/ai-saas-starter · 27.4sExample report
2 critical
3 high
5 medium
0 low
commit 3e9d127 · 10 findings
CRITICALgitleakssupabase_key_exposed_in_client_bundle
dist/assets/index-c4a81f.js:1
createClient("https://xyzcompany.supabase.co",
  "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIn0…")
What's wrong:
A Supabase key with the service_role claim is shipped inside your client JavaScript bundle. Unlike the anon key, this one bypasses Row Level Security entirely — anyone who opens DevTools can read and write your whole database.
How to fix it:
Rotate the key in Supabase → Settings → API. Use the service-role key only in server-side code, referenced via an environment variable that never gets bundled into the client.
CRITICALsemgrepsql_injection_in_api_route
app/api/orders/route.ts:18
const orders = await db.query(
  `SELECT * FROM orders WHERE user_id = ${searchParams.get("uid")}`
);
HIGHgitleakshardcoded_jwt_secret
lib/auth.ts:7
const JWT_SECRET = "super-secret-change-me-later";
+ 7 more findings in the full report

How it works

  1. 01

    Paste a repo URL

    Any public GitHub repository. No signup, no OAuth, no access to your account.

  2. 02

    Real engines scan it

    We run Semgrep and Gitleaks — the same tools security teams use — against your code and git history.

  3. 03

    Get fixes in plain English

    Every finding comes with an AI explanation: what's wrong, how to fix it, why it matters.

Trust

repos scanned
findings explained
0repos stored — ever

Built by Joris, CS student at TUHH Hamburg · GitHub ↗ · LinkedIn ↗

Private repo? Deployed app?

Private repo scanning and URL scanning are coming next. Leave your email and you'll be first in line.

powered bysemgrep+gitleaks+llms
© 2026 vibe vettedicons by Flaticonwe never store your code