NordKiln vs Bleek
Both scan apps built with Cursor, Lovable, Bolt and similar tools. Bleek is further along as a live URL scanner. NordKiln's difference is logged-in A/B testing: can user B read user A's data?
| NordKiln Scan | Bleek | |
|---|---|---|
| Free URL scan | Planned. A free Supabase checker is live now. | Live today: headers, cookies, TLS, exposed files, public secrets, CORS. No signup. |
| Supabase / Firebase | RLS and leaked service_role on the free checker; deeper checks in the scanner. | RLS and Firebase rule probing on the paid Deep Scan. |
| Logged-in cross-user access (IDOR) | Core of the $19 Launch Pass: two test accounts you create. We check whether B can read, change or delete A's records. | Listed under the human audit (from about $300), not the automated scan. |
| Fix help | Plain English plus copy-paste prompts for Cursor, Claude Code, Replit, Bolt and v0, then a re-scan. | Copy-paste fixes for Cursor, Claude and Lovable on the Deep Scan. |
| Price (as published) | Free scan planned; Launch Pass $19 one-time; monitoring $9/mo later. | Free scan; Deep Scan $19 one-time; human audit from about $300. |
| Ownership check | Deep scans only after you prove you own the app. Probes are read-only. | Read-only URL scan; human audit asks for read-only repo access and test accounts. |
Bleek details from bleek.dev (home, pricing, human audit) as of 15 Oct 2026. Their product changes; check their site for current pricing.
When to pick which
Choose Bleek if
You want a scan of the public site right now: headers, leaked keys, open files, and injection probes, without creating test users.
Choose NordKiln if
Your worry is "user B sees user A's data". That needs two logged-in accounts, which URL scanners do not do. Join early access and use the free Supabase check while the scanner opens.
Get early access
One email when the scanner opens, then occasional notes. Unsubscribe anytime. We use FormSubmit; your address goes to dan.nordkiln@gmail.com and is not sold.