Security monitoring for AI-built apps
See what a stranger can do to your app in 30 seconds.
Paste your URL. We check your public JavaScript for leaked secret keys, test whether your public Supabase key can read your tables, and look for exposed /.env and /.git files and missing security headers. No sign-up.
On 30 Oct, Supabase stops exposing new tables to its Data API by default. Tables you already have keep their current access, so check them now.
No sign-up. Read-only GET requests to what your site already serves publicly. Scan only sites you own or are allowed to test.
- No sign-up for the quick check
- Read-only GET requests
- Free account for the full scan
- How it works
3 new issues since last deploy
Graded critical → low, each with a fix
- critical
Stripe secret key in JS bundle
sk_liv…9QxT
- high
profiles table readable with anon key
limit=1 → rows returned
- medium
Missing Content-Security-Policy
Snippet for next.config.ts
Works with apps built and shipped on
Works with apps built on Lovable, Bolt, v0, Cursor, Replit, Supabase, Vercel, Netlify.
Live scan
See what a stranger sees, before they do.
Every scan reads your public bundles and endpoints the way any visitor's browser would. Secrets are never shown or stored in full; you get masked values like these:
- Stripe secret··········· ···· ······
- Supabase service_role··········· ···· ······
- OpenAI key··········· ···· ······
Why it matters
of the Supabase apps that responded in one public scan of 30,998 AI-built apps served database rows without auth (2,096 of 3,680).
Source: r/vibecoding postchecks per scan: secret patterns, RLS exposure on the tables your code uses, buckets, dotfiles, source maps, headers.
rows of your data stored. We record only yes/no and masked values.
How it works
Set it up once. We keep watching.
- 1
Add your domain
Sign in and add your app's production URL.
- 2
Prove you own it
Add a DNS TXT record or /.well-known/abbilabs.txt. No verification, no full scan.
- 3
Get your report
Findings graded critical → low, each with a copy-paste fix.
- 4
Stay protected
Weekly and post-deploy re-scans. We email you only when something new appears.
What we check
The mistakes AI code generators make most.
And the ones attackers check first.
Secrets in your bundle
Leaked API keys
service_role JWTs, sk_live Stripe, OpenAI, Anthropic, AWS, GitHub tokens and more. Always shown masked.
Production source maps
Your original source code readable by anyone.
Customer data
Open Supabase tables
The tables your app's JavaScript references, plus common names like users, profiles and orders, checked with limit=1 against your public anon key. We store only yes or no.
Public storage buckets
Buckets anyone can list or read.
Server hygiene
Exposed .env and .git
/.git/HEAD, .env files and other dotfiles served by mistake.
Security headers
CSP, HSTS and clickjacking protection, with snippets for Vercel and Next.js.
Re-scan on every deploy
Every app gets a secret webhook URL. Call it after each deploy from Vercel, Netlify or CI and Abbi Labs compares the new scan with the last one, so you hear about new exposures right away and see which ones you fixed.
Pricing
Simple pricing
Scan free. Pay once to unlock the full report, or subscribe so we keep watching after every deploy.
- Free: your grade, issue counts and your worst finding with its fix.
- US$19 once: every finding and fix for one app, plus 30 days of re-scans to check your fixes.
- US$19/mo: we re-scan up to 3 apps weekly and after every deploy, and email you only when something new shows up.
Free scan
- One scan of one verified domain
- Security grade + issue counts by severity
- Your top finding shown in full, with its fix
Full Report
Per app- Every finding unlocked
- Copy-paste fix instructions for each
- 30 days of free re-scans to confirm your fixes
- First month of Monitor free
Monitor
Up to 3 apps- Weekly automatic re-scans
- Deploy-triggered scans (Vercel / Netlify / CI)
- Email alerts only on new issues
- Scan history & diffs
- Full reports included
Prices in USD. Full Report is a one-time payment per app. Subscriptions cancel anytime from the billing portal. This is an indicative scan, not a pentest.
FAQ
Questions, answered
Is this a penetration test?
No. Abbi Labs runs an indicative, automated, passive scan. It only makes read-only HTTP GET requests to what your site already serves publicly. It does not exploit, brute-force, or fuzz anything, and it is not a substitute for a professional security audit.
Can I scan someone else's site?
Only scan sites you own or are allowed to test. The no-sign-up quick check looks only at what any visitor's browser can already see: the home page's security headers, its public JavaScript files (for secret keys), /.env and /.git/HEAD, and whether the public Supabase key in that JavaScript can read the tables your code references or common tables (limit=1, yes/no only). It shows issue counts and one finding, and is rate limited. The full scan, every finding, re-scans and alerts only run after you prove ownership with a DNS TXT record or a file at /.well-known/abbilabs.txt.
Do you store my data?
When we test whether a Supabase table is readable with your public anon key, we request at most one row and store only a yes/no. Secrets we find are shown masked. We never store your rows or full keys. For the no-sign-up quick check we keep only the domain scanned, the issue counts and a one-way hash of your IP address (for rate limiting).
Which stacks do you support?
Anything served over HTTPS, with extra checks tuned for apps built with Lovable, Bolt, v0, Cursor and Replit on Supabase and Vercel.
What do I get for free, and what does the US$19 report add?
The free scan shows your grade, how many issues we found at each severity, and your most serious finding in full with its fix. The one-time Full Report (US$19 per app) unlocks every finding and fix and includes 30 days of free re-scans of that app from the purchase date (up to one an hour, 20 in total), so you can fix things and confirm they're gone. If you then subscribe to Monitor within 14 days, your first month is free.
How do deploy-triggered scans work?
Each app gets a secret webhook URL. Call it after each deploy from Vercel, Netlify or CI and we re-scan.
Find out what your app is leaking in 60 seconds.
Quick check with no sign-up at the top of this page. Free full scan for domains you verify. No card.
Weekly AI-app security checklist
One short email a week: a practical check for apps built with Supabase, Next.js and AI tools (RLS, leaked keys, headers and more). Unsubscribe anytime.