Find the leaked keys, open databases and unprotected routes in your AI-built app before someone else does.
Paste your GitHub repo and live URL. In about 5 minutes you get a clear verdict (cleared, fix first, or not cleared), a plain-English report, and one prompt file that makes Cursor or Claude fix it all.
OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase service_role, in your code, your full git history and your live JavaScript.
A key found in both your repo and your deployed site is flagged LIVE, rotate now, so you know what to fix first.
We count which tables anyone can read with your public anon key. Row counts only; we never read your data.
Next.js and Express routes that change data or call paid APIs without checking who's logged in.
Webhooks that don't verify Stripe's signature, so anyone could unlock paid features for free.
AI keys shipped to the browser and AI, login or email endpoints with no rate limit.
Downloadable .env, .git, source maps and .DS_Store on your live site.
Security headers, cookie flags, CORS and known-vulnerable dependencies.
Only normal GET/HEAD requests. No logins, no writes, no attack payloads.
DNS TXT or /.well-known file for your URL; GitHub sign-in for your repo. We won't scan anything else.
Keys appear only as a prefix plus fingerprint. Raw values are never stored.
Repo clones are deleted right after the scan; reports are deleted after 30 days.
Anyone shipping an app built with Cursor, Claude, Lovable, Bolt, v0 or Replit who wants a fast, plain-English safety check before (or after) launch.
A full scan of your public GitHub repo and live URL, a report with a verdict, score and fix-first list, a fix-prompts file you paste into Cursor or Claude, and one free re-scan within 14 days to confirm your fixes.
We only scan things you own. You add a short token to your DNS or a file at /.well-known/, and sign in with GitHub to prove access to the repo. This protects other people's sites from being scanned without permission.
No. Every check is read-only: we only send normal page requests. We never log in, submit forms, write to your database, or send attack payloads.
No. Your repo is cloned to a temporary folder and deleted when the scan ends. Secrets in the report are shown only as a short prefix plus a fingerprint.
No. The anon key is public by design. We use it the way any visitor could to check whether your row-level security actually protects your tables.
No. It's an automated check for the most common mistakes in AI-built apps. A clean report doesn't guarantee your app is secure.
You get a full refund. Email clearancehq@mail.grokbot.com.