What does the SaaS security check measure?

It detects backend-as-a-service config in your client code (Supabase, Firebase, Appwrite) and explains the real risk, scans shipped JavaScript for secret-shaped keys (shown masked), looks for client-side auth smells like tokens in localStorage and admin routes in the bundle, lists the API endpoints your client references, and audits security headers, cookies and CORS. Every finding shows its evidence.

Do you read my database or call my API?

No, and this matters. When we detect a backend key we report its presence and the risk if your access rules are misconfigured; we never use it to read your tables. When we list API endpoints we list the paths referenced in your client code; we never call them with data or dump a response. It is detection and inventory, never exploitation.

My Supabase anon key showed up. Is that a leak?

The anon key is meant to be in the client, so it is not a leak by itself. It is only safe if Row Level Security is enabled and every table has a policy. We flag it so you verify that yourself: without RLS, that key can read or write your tables directly. The same logic applies to Firebase, where everything rides on your Security Rules.

Is this legal to run on my app?

Yes. It is strictly passive and only reads what your front-end already serves to any browser. It never logs in, never submits, never brute-forces and never sends a payload. It is an indicative posture check, not a penetration test. Deeper, authenticated testing belongs in a signed engagement.

Is your AI-built SaaS leaking data?

A passive security check for SaaS front-ends built with Lovable, Bolt, v0, Cursor and Claude. We detect exposed backend config, client-side auth smells and your API surface, from the code your app already ships. Detection only, never exploitation.

Your score

Category scores

Top issues found

Scan a different page

Get the full report free

Every issue with evidence and a recommended fix, emailed to you within 5 hours.

First name

Last name

Work email

Phone (with country code)

Company

Your role

Monthly traffic

Budget range (optional)

What do you need?

Preferred contact

Your full report is on its way

It is being prepared by our system and will arrive at within 5 hours, usually much sooner.

Book a call to walk through it

Passive detection and inventory only. We never read your database, call your endpoints with data, or use any detected key. Findings are indicative, not a penetration test.

What we check

Backend exposure

Detects Supabase, Firebase and Appwrite in your bundle and explains the row-level-security risk. We never query your backend.

Client-side auth

Tokens in localStorage and admin routes referenced in the bundle: signals that auth logic leaked to the client.

API surface

Lists the API endpoints your client references so you can confirm each one enforces auth. We do not call them.

Secrets in JavaScript

Scans for live secret keys and private-key blocks, shown masked, never in full.

Security headers

CSP, HSTS, clickjacking and MIME-sniffing protection, plus cookie flags and CORS.

Exposed files

.env, .git config and backups, checked for existence only.

Want it secured properly?

We take AI-built SaaS to production: hardened auth, correct access rules and a front-end that does not hand out the keys.

Hire a SaaS team Talk to us