A key in client-side JS
OpenAI, Gemini, Stripe, Resend — bundled and visible to anyone. The bill for someone else's usage arrives to you.
Pre-deploy check
Your AI-built app
should not leak
DeployGuard scans a live site built with Lovable, Bolt, Cursor or v0: keys left in the client bundle, open Supabase and Firebase databases, unprotected AI endpoints. You get a score, a list of real issues and a fix prompt you can paste into your coding agent.
First passive scan is free. No card, no signup.
For agencies: one free security review
Send us a client site. We scan it, send you the report, and you decide what to do with it. No cost, no signup, no follow-up sequence.
What usually turns up in AI-built sites: API keys in the client bundle, Supabase tables readable without signing in, missing CSP and clickjacking protection.
What usually leaks in vibe-coded apps
Wide-open Supabase
RLS is off or set to "allow all". A table with user emails can be read without logging in.
An unprotected AI endpoint
Prompt injection pulls out the system prompt, and the agent's tools execute someone else's commands.
"Does it even work?"
The login form returns 500, a page crashes with a runtime error, internal links lead nowhere.
Three steps, two minutes
-
1
Send the URL
Open the bot and send a link. The passive scan starts immediately and costs nothing.
-
2
Get the report
A 0–10 score, issues ranked by severity, and a command to verify each one yourself.
-
3
Fix and re-check
Paste the fix prompt into Cursor or Lovable, then hit "Verify fix" to see whether the hole is actually closed.
51 checks against a live app
No access to your repository — only what any visitor can see from the outside.
Secrets and keys
OpenAI, Anthropic, Groq, Stripe, Resend, Firebase service accounts, Supabase service_role, database URLs with passwords, private keys — in HTML, JS and source maps.
Databases and storage
Supabase RLS per table, public Storage buckets, Firebase RTDB and Firestore, open S3 and GCS buckets.
AI surface
Prompt injection, jailbreak, system prompt leak, AI-mediated XSS, excessive agency, agent instructions exposed publicly.
Web hygiene
CSP, HSTS, X-Frame-Options, Referrer-Policy, CORS with credentials, cookie flags, mixed content, SRI.
Exposure and logic
Open redirect, path traversal, exposed dumps and admin panels, GraphQL introspection, extra HTTP methods, debug modes.
Dependencies
If the deployment serves package.json, versions are matched against the OSV database and known CVEs are reported.
How this differs from a regular scanner
Fix & Verify
Finding the issue is half the job. One button re-checks that specific finding after your fix.
Regression monitoring
If a hole was closed and comes back, you get a separate alert. That is what a subscription is for.
Client-ready report
HTML report and SARIF output: hand it to a client or attach it to a release. Built for agencies that ship sites.
Pricing
The first passive scan is free — no card needed. Paid plans are being connected: for now we enable access manually, just email support@deployguard.app.
Free
$0
- 1 passive scan per month
- Score and top 3 issues
- No card
Starter
$19/mo
- 10 scans per month
- Fix prompt for Cursor
- Scan history
Pro
$39/mo
- Monitoring and regression alerts
- Fix & Verify
- HTML report and SARIF
Agency
$199/mo
- 10 domains
- White-label client report
- Priority support
Questions
Is it legal to scan a site?
Only sites you own. A full scan requires proving domain ownership: you publish a file or a meta tag and we verify it. Scanning someone else's site is not allowed — it is stated in the terms of service.
Do you guarantee the site is secure?
No, and nobody can. This is a fast automated check against 51 known classes of problems, not a full audit or a penetration test. No findings does not mean no vulnerabilities.
Do you produce false positives?
Sometimes, so every finding has "Real" and "False positive" buttons. False ones are remembered and hidden, and each finding includes a command so you can verify it yourself.
What happens to my data?
We store scan URLs, results and your Telegram ID. We never sell it or share it for advertising. Secrets found in scans are masked in reports and logs.
Can I get a refund?
If a scan fails technically, the credit returns to your balance automatically. If a payment went through but the plan was not recognised, we refund within 24 hours. See the Refunds section.