Is your AI-built app leaking your users' data?
Free check before you launch. We test your app like a real user would, including whether one logged-in user can see another user's private data, and give you plain-English fixes. Works with apps built in Cursor, Bolt, Replit, v0 and Lovable.
No spam. One email when the scanner opens, plus an occasional newsletter. Unsubscribe anytime.
How it works
1. Paste your URL
Free scan for leaked API keys, open Supabase/Firebase and missing security headers.
2. Add two test users
We log in as user A and user B and check whether B can read, edit or delete A's data.
3. Fix and verify
Plain-English findings, copy-paste fix prompts for Cursor, Claude Code, Replit, Bolt or v0, then a re-scan and a "verified safe to launch" badge.
Free tools
Supabase RLS checker
Client-side check: is your anon key safe? See which tables anonymous visitors can read, and catch leaked service_role or API keys. Nothing is uploaded.
Built for apps made with
Cursor · Claude Code · Replit · Bolt · v0 · Lovable, using stacks like Next.js, Supabase, Firebase, Clerk, Convex and Stripe.
Frequently asked questions
What is a vibe coding security scanner?
A tool that checks apps built with AI coding tools (Cursor, Claude Code, Replit, Bolt, v0, Lovable) for the security mistakes AI tends to make: exposed API keys, open Supabase or Firebase databases, and missing access control. NordKiln Scan also logs in as two test users to check whether one user can read another user's data.
Is my Lovable, Bolt or Replit app secure?
Not automatically. The most common problems are database tables without Row Level Security, Firebase rules that allow public reads, and secret keys shipped in frontend JavaScript. A scan that tests both anonymous and logged-in access is the quickest way to know.
How do I check my Supabase RLS policies?
Make sure Row Level Security is enabled on every table, then test with a real logged-in user: user B must not be able to select, update or delete rows owned by user A. NordKiln Scan does this with two test accounts and shows exactly which tables leak.
My Supabase anon key is exposed. Is that a problem?
The anon key is meant to be public, but only if RLS protects every table. A leaked service_role key is critical: it bypasses all security. Rotate it immediately in the Supabase dashboard and move it to server-side code.
How do I check my Firebase security rules?
Rules like allow read, write: if true or if request.auth != null let anyone (or any signed-in user) read everything. Rules should check that request.auth.uid matches the owner of the document.
How do I scan my website for exposed API keys?
Look through the JavaScript bundles your site serves for keys from OpenAI, Stripe, Supabase service_role, AWS and similar. NordKiln Scan does this automatically and explains each finding in plain English.
My OpenAI API key leaked in the frontend. What should I do?
Revoke it now in the OpenAI dashboard, create a new key, and call OpenAI only from a server route or edge function with rate limiting. Also set a monthly spending limit to avoid surprise bills.
What should a Cursor app security checklist cover before launch?
No secrets in client code, access control on every table and API route, users unable to read each other's data, rate limits on paid APIs, and a privacy policy. Our scanner checks these and gives you fix prompts for your tool.
How is NordKiln different from Bleek, Vibeproof or Lovable's built-in scan?
Most scanners only check what an anonymous visitor sees. NordKiln tests what logged-in users can see, gives fix prompts for Cursor, Claude Code, Replit, Bolt and v0, re-scans to verify the fix, and issues a 'verified safe to launch' badge.
Can I scan any app?
No. Deep scans are only for apps you own or are authorized to test, and we ask you to prove ownership. Our probes are read-only.
About NordKiln
NordKiln is a small Norwegian software studio. We build practical tools for people shipping software with AI. NordKiln Scan is our first product. Follow along at @nordkiln.