Loading...
Deep security audit for AI-built apps. We find leaked keys, scan your database security rules, and give you a Ship/Block verdict with copy-paste fix prompts.
Free account. 10 seconds to sign up. 3 scans/month.
8
Security providers
<10s
Average scan time
3
IDE fix formats
$0
To get started
How it works
We fetch your app's HTML and JavaScript, scan for exposed secrets, check HTTP headers, and query OSV for dependency CVEs.
Link Supabase or Firebase. We analyze every RLS policy, parse Firestore rules, check auth config, and audit storage buckets.
Copy-paste fix prompts tailored for Cursor, Lovable, and Claude Code. Fix each issue in seconds, not hours.
Security checks
Every scan runs these checks in parallel. Results in under 10 seconds.
Secrets Scanner
55 patterns — AI keys, payments, cloud, auth, DBs
Supabase RLS
Policy logic — catches USING(true)
Firebase Rules
Firestore, RTDB, Storage rules audit
Auth Flow
Unprotected endpoints, CSRF, cookies
DAST / Nuclei
Headers, CORS, XSS, open redirects
Payments
Stripe keys, unsigned webhooks
Dependencies
CVE scanning via OSV querybatch
Blast Radius
Calculates the damage from each leaked key — limitless API spends, database wipe, account takeover
Daily automated re-scans. We monitor your production headers, newly discovered CVEs in your dependencies, and configuration drift. Email and Telegram alerts the moment a new vulnerability hits your app.
Automatic security audits every 24 hours. Catch regressions after every deploy.
New vulnerability in your dependencies? We detect it within hours, not weeks.
5-minute health checks. Monitors security headers, TLS certificates, and availability.
Instant alerts on score drops, new critical findings, and downtime.
Auto-scan on every Vercel deploy. Block insecure code before it reaches production.
The problem
USING(true) = RLS "enabled" but database fully open.What other scanners see
✓ RLS: enabled ✓ Policies: 3 found ✓ Auth: configured Result: PASS ✓
What Sekrd finds
⚠ CRITICAL: users table
Policy: USING (true)
→ Anyone with anon key
can read ALL user data
Fix: USING (auth.uid() = id)Why Sekrd
We know you're trusting us with access to your backend. Here's how we handle it.
Read-only access
We never modify your database, RLS policies, or security rules. Strictly read-only audit.
Keys deleted after scan
Your credentials are used once for the audit, then immediately deleted. We never store them.
Encrypted in transit
All data transmitted over HTTPS/TLS. Scans run in isolated environments.
Works with your stack
Pricing
Start free. Upgrade when you need deep auditing.
Quick external checks
Full deep audit
Continuous security monitoring
Join developers who ship with confidence. Sign up in 10 seconds, scan for free.