[ BB / 01 ] SECURITY, WITHOUT THE MYSTERY
You built something.
Let’s see what’s hiding in it.
From your first Lovable app to your next Rust release. Find risky code, understand why it matters, and get a clear way forward.
A little less haunted. A little more confident.Choose a repository. We’ll read between the lines.
Demonstration: these findings come from our deliberately risky sample project, not a customer repository.
Download your report before leaving. Results are not saved as a hosted page in this testing release.
[ 01 ] A SECOND PAIR OF EYES
Security advice should make sense whether you wrote every line, or asked an AI to write the first draft.
Paste a public GitHub URL or upload a source ZIP. Lovable project? Sync it to GitHub or export the code first.
Targeted checks look for risky source patterns, private-key headers and, optionally, known vulnerable dependency versions.
Each finding explains the mechanism, points to the file, and gives a recommendation. Download it, fix it, check again.
JavaScript / TypeScript · Python · Rust · PHP · SQL
Targeted rules, not exhaustive language coverage. Every report explains its limits.
[ 02 ] GHOST STORIES
What went wrong. What could happen. What to change.
Findings you can actually act on.
A request parameter walks straight into a command shell. The missing boundary is one line of code.
A preview looks harmless. The question is who gets to decide what goes into it—and what the browser runs.
One migration removes a row-level boundary. Check which users can still reach the data behind it.
These are illustrative stories from our downloadable demo repository. Real findings need their own evidence.
BLACKBOX / INDUSTRIAL DESIGN CONCEPT
[ 03 ] KEEP IT IN THE BOX
In developmentA dedicated, AI-accelerated security appliance for your desk. Designed around Raspberry Pi 5 and the AI HAT+ 2.
The appliance is being prototyped. Performance and analysis coverage are still being validated.
I want one on my desk ↗[ 04 ] THE HONEST VERSION
Yes. Source reviews, complete reports and repeat scans are free during the beta. The current limit is 25,000 nonblank source lines, 10 MiB compressed and 40 MiB expanded, with up to 4,000 archive entries. There is a 30-request hourly allowance to keep testing available.
Yes. Connect your Lovable project to GitHub and use a public repository URL here, or upload an exported source ZIP. Private repositories can be reviewed through a ZIP without sharing a GitHub token. Database configuration and deployed RLS policies need separate verification.
A source-pattern match is a lead for code review, not an exploit proof. A dependency match means an advisory lists the exact version. The beta labels these separately and does not execute your application, prove exploit chains or certify a clean repository as safe.
The hosted beta processes source and reports in memory on our EU infrastructure. It does not save them in a database, train models on them, or send source to an AI provider. Download your report before leaving. Infrastructure may retain ordinary connection metadata. Optional advisory checks send only package names and versions to OSV. Finding feedback stores rule IDs and aggregate votes, not source or file paths.
GitHub installation, owner-authorized publishing and the ten-day Ghost Story disclosure workflow are planned features. This testing release does not automatically publish reports or create GitHub issues.
Today: targeted source review, optional dependency advisory checks, ZIP and public GitHub intake, downloadable Ghost Stories, and finding feedback. Next: deeper research-engine integration, private GitHub App access, verified chains, fix pull requests, authorized live-site checks and continuous monitoring.