Clone Security

Highlights

• 

  Find API routes anyone can call without signing in

  For anyone shipping a web app a coding agent helped build: find the API routes and server actions that strangers can call without signing in, before someone else does. Lists every route in Next.js, SvelteKit, Express, or Hono code, flags writes with no auth check, webhooks that skip signature checks, admin routes with no role check, and ids that let one user reach another user's records, then drafts the fixes for you to approve. Reads code only; never sends a request.

  Creator's example: Cover

• 

  Check your npm packages for risky dependencies

  For anyone shipping a JavaScript app: find the npm packages that could hurt you before an attacker does. Reads package.json and package-lock.json and flags look-alike package names one typo from a popular one, packages installed straight from git or a URL, versions like "*" or "latest", packages that run scripts on install, a missing or stale lockfile, and known vulnerabilities from npm audit, then walks you through each fix. Never installs or runs a package.

  Creator's example: Cover

• 

  Check your Firebase rules before you launch

  For anyone launching a Firebase app: check that strangers and other users cannot read or change your Firestore, Storage, or Realtime Database data. Reads your rules files and flags test-mode rules that expire, rules open to anyone, rules that only check "signed in", catch-all wildcards that override everything, profiles where users can edit their own role or plan, and uploads with no size limit, then drafts safer rules for you to test in the emulator. Never connects to Firebase.

  Creator's example: Cover

• Security audit for your web app before launch

  Get a written security audit of your web app before launch or after a big feature. Covers the API, sign-in and OAuth, MCP connectors or CLIs, and file uploads, and writes a threat model plus numbered findings with severity, fix, and how each fix was verified. Reads the code and runs signed-out checks only; never changes your code.

• Secure your Stripe webhook against fake payments

  Make sure nobody can fake a payment or get double credit through your Stripe webhook. Finds your handlers and checks signature verification, raw body, signing secret in env, once-only processing, 400 on bad signatures, and that access comes from the webhook, not the success page, then proposes diffs. Reads your code only; never calls Stripe.

  Sample run: flags an App Router handler that parses JSON and never verifies the signature: Webhook scan

• Stop users seeing each other's data in Supabase

  Check that strangers and other users cannot read or change your data in Supabase before you launch. Replays your migrations to find tables with row level security off, policies that let anyone write or trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only; never touches your database.

  Sample run: flags a table with RLS off and a policy that lets any user write: Rls audit