Skip to content
StackSiren
Free scan

Passive scanner for Lovable, Bolt, Replit, Cursor & v0 apps

The siren for your AI-built app: hear about leaks before someone else finds them.

StackSiren flags leaked API keys, Supabase tables that may lack Row Level Security, missing security headers and SEO gaps in under a minute, with fix prompts you can paste straight back into your AI builder. Add weekly rescans and it flags what changed each week.

We use your email to link your score to your report and account. We only add you to our mailing list if you tick the newsletter box. Privacy.

Free score and full issue list · Full report from $9 · Weekly rescans from $19/mo

How it works

  1. 01

    Paste your URL

    Any public site: lovable.app, bolt.new, replit.app, vercel.app or your own domain.

  2. 02

    We run passive checks

    A handful of normal GET requests, the same a browser makes. Usually 5–30 seconds.

  3. 03

    Fix with one paste

    Get a score and every issue free. Unlock the full report for explanations, evidence and AI-ready fix prompts.

What we check

Exposed secrets

OpenAI, Anthropic, Stripe secret, AWS and GitHub keys, plus Supabase service_role keys, in your HTML and JS bundles.

Supabase & Firebase

Spots public Supabase keys and reminds you to verify Row Level Security. Recognises Firebase config (public by design).

Security headers

CSP, HSTS, clickjacking protection, nosniff, Referrer-Policy and Permissions-Policy.

HTTPS, cookies & CORS

Valid HTTPS, HTTP→HTTPS redirect, mixed content, cookie flags and wildcard CORS.

Exposed files

Publicly downloadable /.env, /.git/config and production source maps.

SEO & performance

Title, description, Open Graph, canonical, robots.txt, sitemap, accidental noindex, JS-only rendering and bundle weight.

See what a report looks like

Every issue comes with a severity, the evidence we found (secrets masked), a plain-English explanation and a fix prompt written for AI coding tools. Re-open your report link any time to re-scan and confirm your fixes.

The preview is an example with made-up data.

example-app.lovable.appExample report
52
score / 100
  • criticalOpenAI API key in public JavaScriptSecrets

    sk-proj…f3Qa in /assets/index-8f2c.js

  • highSupabase key found: verify Row Level SecuritySecrets

    https://abcd….supabase.co

  • mediumNo Content-Security-Policy headerSecurity

    Response headers from /

  • lowMissing meta descriptionSEO

    <head> of /

  • Fix prompt (paste into Lovable / Bolt / Cursor)

    Move the OpenAI call from the browser into a Supabase Edge Function. Read the key from a function secret…

Illustrative example with made-up data. Your report shows what your own site actually serves.

Simple pricing

The scan and score are free. Pay for full reports, or let us rescan your apps every week. Already a customer?

Single report

$9 one-time

  • 1 full report for the app you scanned
  • Evidence + plain-English explanation
  • Copy-paste fix prompts
  • Re-open the report to re-check fixes

10-report pack

$49 one-time

  • 10 full reports, any apps
  • Credits never expire
  • 1 credit per unlocked report
  • Everything in Single
Monitoring

Solo

$19 /month

  • 1 monitored app
  • Automatic weekly rescan
  • Changes flagged each week in your account
  • Unlimited full reports for that app

Builder

$49 /month

  • Up to 5 monitored apps
  • Automatic weekly rescans
  • Changes flagged each week in your account
  • Unlimited full reports for those apps

Secure checkout by Stripe. Cancel plans any time from your account. Prices in USD.

Guides by builder

Lovable →Bolt →Replit →Cursor →v0 →Exposed API keysSupabase RLSSecurity headers

FAQ

Is the Supabase anon key a problem?+

No. The anon/publishable key is meant to be in your frontend. The risk is tables without Row Level Security, because anyone with that key can query them. StackSiren flags the key as a reminder to verify RLS and never queries your database. A service_role key in the frontend, however, is critical.

Is this a penetration test?+

No. StackSiren is a passive check of what your site serves publicly. It doesn't log in, brute force, fuzz or send attack payloads, and it can't see server code, database rules or pages behind login.

Do you store my site's data or secrets?+

We don't store page content. Secrets found are always masked. Monitoring plans store your app URLs and a short summary of each weekly rescan (score, issue types, what changed) with our payment provider, Stripe.

Which builders does it work with?+

Any public website, including Lovable, Bolt, Replit, Cursor-built apps, v0/Vercel, Netlify and Webflow. Fix prompts are written to paste into AI coding tools.

What happens after I pay?+

You get a private account link (and a sign-in cookie on that device). Single reports open immediately; packs add 10 credits that never expire; plans add your app to weekly monitoring. Manage or cancel plans any time in the Stripe customer portal.

What if I've exposed a key?+

Revoke or rotate it in the provider's dashboard straight away, then move the call that uses it to a server-side function. Removing it from code isn't enough, because it may already have been copied.

Honest limits

  • Only scan sites you own or have permission to scan. See the terms.
  • StackSiren is passive: a small number of normal GET requests to your home page, same-origin JavaScript, robots.txt, sitemap.xml, /.env and /.git/config. No logins, brute force, fuzzing or database queries.
  • A good score doesn't prove an app is secure. We can't see server code, database rules or pages behind login. It's a fast first check, not a penetration test.