Loading the profile
Loading the profile
We use cookies you can say no to for analytics, ad measurement, and embedded videos. Signing in works either way. You can change this any time from Cookie settings at the bottom of every page. What we use
For anyone shipping a web app a coding agent helped build: find the API routes and server actions that strangers can call without signing in, before someone else does. Lists every route in Next.js, SvelteKit, Express, or Hono code, flags writes with no auth check, webhooks that skip signature checks, admin routes with no role check, and ids that let one user reach another user's records, then drafts the fixes for you to approve. Reads code only; never sends a request.
For anyone shipping a JavaScript app: find the npm packages that could hurt you before an attacker does. Reads package.json and package-lock.json and flags look-alike package names one typo from a popular one, packages installed straight from git or a URL, versions like "*" or "latest", packages that run scripts on install, a missing or stale lockfile, and known vulnerabilities from npm audit, then walks you through each fix. Never installs or runs a package.
For anyone launching a Firebase app: check that strangers and other users cannot read or change your Firestore, Storage, or Realtime Database data. Reads your rules files and flags test-mode rules that expire, rules open to anyone, rules that only check "signed in", catch-all wildcards that override everything, profiles where users can edit their own role or plan, and uploads with no size limit, then drafts safer rules for you to test in the emulator. Never connects to Firebase.
Get a written security audit of your web app before launch or after a big feature. Covers the API, sign-in and OAuth, MCP connectors or CLIs, and file uploads, and writes a threat model plus numbered findings with severity, fix, and how each fix was verified. Reads the code and runs signed-out checks only; never changes your code.
Make sure nobody can fake a payment or get double credit through your Stripe webhook. Finds your handlers and checks signature verification, raw body, signing secret in env, once-only processing, 400 on bad signatures, and that access comes from the webhook, not the success page, then proposes diffs. Reads your code only; never calls Stripe.
Check that strangers and other users cannot read or change your data in Supabase before you launch. Replays your migrations to find tables with row level security off, policies that let anyone write or trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only; never touches your database.
Go from it works on my machine to safe in production: a launch checklist for your stack, no leaked secrets, locked-down database access, hardened payments, and a fast fix when a deploy fails.
5 kits
Find the holes before someone else does: database rules, open API routes, Stripe webhooks, risky packages, and a security review before launch.
