NordKiln Scan: is your app leaking your users' data?
A free check before you launch, for apps built with Cursor, Claude Code, Replit, Bolt and v0. We test your app like a real user would: can a logged-in user see someone else's private data? Most scanners only check what anonymous visitors see. You get plain-English fixes.
No spam. One email when the scanner opens, plus an occasional newsletter. Unsubscribe anytime.
Request a free leak check
We only test apps you own or are authorized to test. We'll email you a quick ownership verification step before any scan.
What we check
Cross-user data access
With two test accounts we check whether user B can read, change or delete user A's records through your API or database. This is broken access control (IDOR), the leak that sinks apps.
Supabase RLS
Tables without Row Level Security, over-broad policies, and a leaked service_role key.
Firebase rules
Firestore, Realtime Database and Storage rules that allow public or any-user reads.
Exposed API keys
OpenAI, Stripe, AWS and other secrets in your JavaScript bundles, plus open AI proxy endpoints without rate limits.
How it works
1. Paste your URL
Free scan for leaked API keys, open Supabase/Firebase and missing security headers.
2. Add two test users
We log in as user A and user B and check whether B can read, edit or delete A's data.
3. Fix and verify
Plain-English findings, copy-paste fix prompts for Cursor, Claude Code, Replit, Bolt or v0, then a re-scan and a "verified safe to launch" badge.
Pricing (planned)
Free scan
Public checks: keys, open databases, headers.
Launch Pass — $19
Logged-in two-user test, full report, fix prompts per tool, re-scan, and a public "verified safe to launch" badge.
Monitoring — $9/mo
Re-scan on every deploy. Later.
Try a free check now
While NordKiln Scan is in early access, use our Supabase RLS checker — it runs in your browser and shows which tables the anon key can read.
Safe and legal by design
Probes are read-only. Deep scans need proof that you own the app (DNS or file verification), and you should only use test accounts you created. See our terms.