Citadel Cyber
Get a free scanJoin the free-scan waitlist
Plan of a bastion fort A line drawing of a five-bastion star fort, with one breach marked in its east wall.
Security reviews for apps built with AI

Your AI builtthe app. Did itlock the doors?

We find the exposed keys, open databases and missing access rules that AI coding tools leave behind. Then we rank them, worst first, in plain English.

Get a free scanJoin the free-scan waitlist See a sample report

Free. No card, no code access. Passive and read-only, and only after you prove the site is yours.

Free scans open soon: no card, no code access. Passive and read-only, and only after you prove the site is yours.

Built for Lovable · Bolt · Cursor · Replit · v0
on Supabase and Firebase

The evidence, 2025 to 2026Sourced, not estimated

170 of 1,645 scanned Lovable projects, about 10%, had inadequate row-level security. Anyone could read their tables. Logged as CVE-2025-48757. Matt Palmer, Statement on CVE-2025-48757, May 2025

Feb 3 to Apr 20, 2026

Any logged-in Lovable user with a link could read the chat history and source code of public projects.

Lovable, Our response to the April 2026 incident

11% of 20,052

indie launches shipped Supabase credentials in their frontend code. That count includes public anon keys, which are safe by design, but only when row-level security is right.

SupaExplorer, Cybersecurity Insight Report, Jan 2026

Platform scanners check that the lock exists. We check that it works.

The product is the report.

Every finding, ranked from most to least dangerous. Each one says what an attacker could do, and how to fix it.

Security Assessmentyourapp.example · Launch Audit · 6 findings
Overall riskHigh
Illustrative sampleNot a real customer
2Critical
2High
1Medium
1Low
0Info
  1. 01

    Service-role key shipped in main bundle

    Anyone can bypass every access rule in your database.

    Critical
  2. 02

    orders readable with the public anon key

    No row-level security policy on the table.

    Critical
  3. 03

    Any invoice readable by changing its ID

    The API trusts the ID in the URL.

    High
  4. 04

    Profile bio rendered as raw HTML

    Stored script runs in other users' browsers.

    High
  5. 05

    DMARC policy set to p=none

    Mail "from" your domain isn't rejected.

    Medium
  6. 06

    Source maps served in production

    Your original source is public.

    Low
Citadel CyberPage 1 of 9

Illustrative layout. Findings are examples of what we look for.

01 / 06Critical

A master key, in plain sight.

AI tools often put the Supabase service-role key, or a Stripe secret key, into the code that ships to every browser.

What an attacker could doBypass every access rule. Read or wipe your database. Run up charges on your accounts.

02 / 06Critical

The lock exists. It doesn't work.

Row-level security that's off, or on but wrong. Platform checkers confirm a policy exists, not that it's correct.

What an attacker could doUse your public anon key to list every user, order or message.

Fix prompt for your AI coder
Enable RLS on public.orders and add a policy so users can only select rows where user_id = auth.uid(). Then test the table with only the anon key.
03 / 06High

Change one number, see someone else.

Endpoints that trust the frontend, or the ID in the URL.

What an attacker could doRead or edit other customers' accounts, invoices and private data.

04 / 06High

Text that runs as code.

Input that reaches your pages, database or edge functions unescaped, behind a weak Content-Security-Policy.

What an attacker could doRun scripts in your users' browsers, steal sessions, tamper with stored data.

05 / 06Medium

Anyone can send mail as you.

SPF and DMARC records that don't stop spoofed mail from your domain.

What an attacker could doPhish your customers with email that appears to come from you.

06 / 06Low

The blueprints, left on the table.

Open .env files, source maps, permissive CORS, missing headers, weak TLS.

What an attacker could doMap your app, collect leftover credentials, find the easiest way in.

Plus an executive summary, what's already working, and a fix prompt for every finding.

Four steps. The first one is permission.

Testing a site without permission is an attack. So we start by proving the site is yours.

  1. /01

    Permission

    You confirm you own the site, then prove it with a DNS TXT record or a meta tag. Anything deeper needs a signed scope authorization. No signature, no testing.

  2. /02

    Read

    The free scan is passive. Headers, DNS and email records, TLS, exposed files, keys in your JavaScript. Only what a browser can already see.

  3. /03

    Rank

    Every finding gets a severity and one sentence on what an attacker could do with it. Critical first. No 200-page noise.

  4. /04

    Repair

    Each fix comes with a prompt to paste into Cursor or Lovable. Then we re-scan, weekly and on every deploy, if you want us to.

For scale: Aikido lists a typical standalone pentest at $4,000 per assessment (aikido.dev/pricing). The Launch Audit isn't a pentest, and it isn't priced like one: $119 founding, normally $249.

What the free scan checks. What the audit adds.

The free scan reads what any browser can see. The Launch Audit goes further, and only with your signed scope authorization.

Free Scan · $0 · passive

  • Security headers and Content-Security-Policy
  • HTTPS, TLS and your certificate
  • SPF and DMARC: can someone send mail as you?
  • Exposed files: .env, source maps
  • Secret keys shipped in your JavaScript, like Stripe, OpenAI and AWS keys
  • Cookie flags on session and login cookies

You get: your top 3 risks and a severity score, by email.

Launch Audit · $119 founding, normally $249

  • Everything in the free scan, with every finding listed, not just the top 3
  • Whether your access rules actually hold: row-level security, and one user reading another's data
  • What an attacker could do with each finding, in plain English
  • A fix prompt for each finding, ready to paste into Cursor or Lovable
  • One re-test after you fix

Full refund before work starts. Compare plans

Pay once. Or stay covered.

Start free. Buy an audit when you need the full picture. Subscribe when you ship every week.

OnceOne-time · no subscription

Free ScanStart here

A passive external check. Your top 3 risks and a severity score, by email.

$0

Get a free scanJoin the free-scan waitlist

Launch AuditRecommended

One live app, reviewed in depth. Ranked findings, attacker scenarios, fixes and AI-coder prompts.$119 founding, normally $249Delivered in 48 hours · 1 re-test includedFull refund before work starts

$119

Book Launch AuditJoin the waitlist

Code AuditWith your repo

Everything in the Launch Audit, plus your source: auth and RLS correctness, secrets in git history, dependencies.1 re-test included · Full refund before work starts

$329

Book Code AuditJoin the waitlist
Ongoing

Guard1 app

Weekly re-scans and scan-on-deploy. Alerts on new critical issues. A full report every quarter.Audit fee credited toward annual Guard bought within 14 days of report delivery

$89/mo

Start GuardJoin the waitlist

ProUp to 3 apps

Monthly code review of changes through our GitHub app. Priority 24-hour reports. SOC 2-oriented findings mapping.

$279/mo

Start ProJoin the waitlist

AgencyUp to 15 client sites

White-label PDF reports, a client dashboard and bulk re-scans.

$699/mo

Start AgencyJoin the waitlist

Prices in USD. Annual plans are billed once a year. Cancel subscriptions any time.Audits: full refund before work starts, none once the report is delivered (Terms 8.4).Not a pentest certificate. For SOC 2 attestations we refer you to a certified firm.

Start with your URL.Book your audit.

Step 1 of 2 · then verify ownership

Free scans open soon.

Email [email protected] to get on the list. Tell us your site's address and we'll write when scans open.

Join the waitlist by email

Only owners can request a scan, and nothing runs until you prove the site is yours. How our scanner works.

Scan and send the results to

Enter your site's address, like yourapp.com.

Enter a valid email so we can send your results.

We can only scan sites you own or are authorized to test, and you need to agree to the Terms and Privacy Policy.

Please answer the health-data question.

Please complete the bot check.

Does this app store or process health data?

Passive and read-only. Headers, DNS and email records, TLS, exposed files, keys in your JavaScript.

Step 2 of 2

Request received. Now prove it's yours.

Why we ask: scanning a site without the owner's permission is an attack. This is how we know it's yours.

The code expires in 72 hours. Shared-host subdomains (like *.lovable.app or *.vercel.app) can only use the meta tag.

Questions.

Can I scan any site?

No. We only scan sites you own or are authorized to test. You confirm it, then prove it with a DNS TXT record or a meta tag before any scan runs. Anything deeper also needs a signed scope authorization. No written permission, no active testing.

Is the free scan safe for my site?

Yes. It only reads public information, the same things a browser sees: security headers, DNS and email records, TLS, exposed files and keys in your JavaScript.

Do you need my code?

No, but code access finds much more, like auth gaps and secrets in your git history. That's what the Code Audit covers.

Is this a pentest or a compliance certificate?

No. It's an automated plus model-assisted assessment. For SOC 2 pentest attestations, we partner with or refer you to a certified firm.

What happens after the free scan?

You get a short report by email with your top 3 risks and a severity score. For the full picture, the Launch Audit ($119 founding, normally $249) delivers a ranked report with attacker scenarios and fixes within 48 hours. Founding price for our first 10 Launch Audits or 60 days after checkout opens, whichever comes first.

What happens after I book an audit?

You verify the domain, we confirm scope, and you sign the scope authorization. The ranked report, with attacker scenarios and fixes, follows within 48 hours.

What if the audit isn't what I expected?

Audits are fully refundable before work starts. Once the report is delivered, they aren't. Every audit includes one re-test after you've made fixes. The details are in the Terms, section 8.4.

My builder already has a security scan. Why this?

Platform checks confirm a rule exists, like row-level security being turned on. The Launch Audit checks whether it actually stops one user from reading another's data, and it covers apps you've deployed outside the builder too. Use both.

What happens to my data?

Findings are confidential and used only to produce your report. Free-scan data is deleted after 30 days. Audit data is deleted 30 days after we deliver the report. See the Privacy Policy.

Top