For founders shipping with Lovable · Bolt · v0 · Cursor · Replit
Ship fast. Leak nothing.
Automatic security scans for AI-built apps after every deploy. Abbi Labs checks your live site from the outside, strictly read-only, for leaked API keys, Supabase tables open to the anon key, public buckets, exposed .env and .git files, and missing headers. It alerts you the moment something new shows up.
Passive GET requests only · Verified domains only · No card for the free scan
Why it matters
of the Supabase apps that responded in one public scan of 30,998 AI-built apps served database rows without auth (2,096 of 3,680).
Source: r/vibecoding postchecks per scan: secret patterns, RLS exposure on common tables, buckets, dotfiles, source maps, headers.
rows of your data stored. We record only yes/no and masked values.
How it works
- 01
Add your domain
Sign in and add your app's production URL.
- 02
Prove you own it
Add a DNS TXT record or /.well-known/abbilabs.txt. No verification, no scan.
- 03
Get your report
Findings graded critical → low, each with a copy-paste fix.
- 04
Stay protected
Weekly and post-deploy re-scans. We email you only when something new appears.
What we catch
These are the mistakes AI code generators make most often, and they're the ones attackers check first.
Open Supabase tables
We find your Supabase URL and anon key in the bundle, then check whether users, profiles, orders, payments and other common tables return rows with limit=1. We store only yes or no.
Leaked secrets
service_role JWTs, sk_live Stripe keys, OpenAI, Anthropic, AWS, GitHub tokens and more. Values are always shown masked.
Public buckets
Storage buckets anyone can list or read.
Exposed files
/.git/HEAD, .env files and production source maps.
Security headers
CSP, HSTS and clickjacking protection, with snippets for Vercel and Next.js.
Re-scan on every deploy
Every app gets a secret webhook URL. Call it after each deploy and Abbi Labs compares the new scan with the last one, so you hear about new exposures right away and see which ones you fixed.
Simple pricing
Start free. Upgrade when you want continuous monitoring.
Starter
- 1 app
- Weekly automatic re-scans
- Deploy-triggered scans (Vercel / Netlify)
- Email alerts on new exposures
- Scan history & diffs
Prices in USD. Cancel anytime from the billing portal. This is an indicative scan, not a pentest.
FAQ
Is this a penetration test?
No. Abbi Labs runs an indicative, automated, passive scan. It only makes read-only HTTP GET requests to what your site already serves publicly. It does not exploit, brute-force, or fuzz anything, and it is not a substitute for a professional security audit.
Can I scan someone else's site?
No. You must prove ownership with a DNS TXT record or a file at /.well-known/abbilabs.txt before any scan runs. Unverified domains are never scanned.
Do you store my data?
When we test whether a Supabase table is readable with your public anon key, we request at most one row and store only a yes/no. Secrets we find are shown masked. We never store your rows or full keys.
Which stacks do you support?
Anything served over HTTPS, with extra checks tuned for apps built with Lovable, Bolt, v0, Cursor and Replit on Supabase and Vercel.
How do deploy-triggered scans work?
Each app gets a secret webhook URL. Call it after each deploy from Vercel, Netlify or CI and we re-scan.