Know what
your AI built.
Paste a repo. In a few minutes you get an audit where every finding cites its evidence — the query we ran, the answer we got.
Runs read-only. Source deleted after the scan. No account needed.
Built with Lovable, Bolt, Cursor, v0, or Replit? We scan what it produced, not how you made it.
Private repositories, verified fix pull requests, and care plans.
Or run a free scan on a public repo
…or upload a .zip / .tar.gz instead
Example finding from a report
scn_01M1…AKVE · report excerpt
Table readable without a session
fix verified · PR #142 opened
Confirmed by the next scan: ▼1 fixed
Vibe-coded apps ship fast. The audit usually doesn't; so we fixed the audit.
checks, counted from the library
from paste to report, 19 scans in 20
verification rungs before a fix PR
of findings cite their evidence — it's the rule
Scan, cite, fix, watch.
We scan read-only, cite evidence for every finding, open verified fix PRs, and keep watching under care.
Scan
Static engines, schema replay, and — with your say-so — live probes, in an isolated sandbox. Read-only, and your source is deleted after the scan.
Evidence
Each finding carries a location and a measured-or-estimated label. The query we ran, the answer we got. No evidence, no finding.
Verified fix PRs
A fix passes a verification ladder — rescan, typecheck, tests — before we open the pull request. You review; nothing merges itself.
Care
Push-triggered rescans, scheduled full scans, and alerts only at the level you choose. A monthly summary of what changed.
Each check asks one specific question of your app.
211 checks across 8 families. From Supabase row-level security to Stripe webhooks — one concrete example per family:
Supabase RLS
a table readable without a session, proven by the query we ran
Keys & secrets
a service-role key in client code, with the file and line
Stripe
a webhook handler that never verifies the signature
Auth
a password reset flow that leaks whether an email exists
API
a server action with no auth check inside its boundary
Performance
a 4 MB bundle measured five times, median reported
Cost
a column that averages 4 KB per row, priced at your tier
Ops
no backups on the database your business runs on
From found to fixed. Every step leaves evidence.
A sample transcript. Nothing here runs against your app without your say-so, and nothing merges without your review.
care run · week four
Push to main, rescanned in 6 minutes
what week four looks like: fewer new, more fixed, nobody paged
Two ways to work with us, and the free scan that starts both.
The free scan costs nothing and needs no account. An audit or a care plan picks up from what it finds.
Free scan
$0
No account needed. One repository, read-only.
- Every check that needs no credentials or live access
- A report with evidence for every finding
- Results usually under 4 minutes
Fix Sprint
$1,490
One time, one repository, scoped to what the scan found.
- The full report at audit depth — seven chapters, evidence bundle
- Every first report checked by a Naqqad engineer before you see it
- Fix PRs for what can be fixed mechanically
- Fix credits toward the sprint: one credit is one straightforward automatic fix, a larger fix uses more than one
- A walkthrough call if you want one
Care plan
$49/mo
One app, cancel any month.
- Rescan on every push, full scan weekly
- Alerts only at or above the level you choose
- One fix a month included (2 fix credits)
- A monthly summary of what changed
Agency Studio
$299/mo
Cancel any month.
- Five apps
- Five fixes a month (10 fix credits)
- Reports under your agency's name
Agency
$699/mo
Cancel any month.
- Twenty apps
- Fifteen fixes a month (30 fix credits)
- Reports under your agency's name
- Slack alerts (set up with us)
Agency Scale
$1,499/mo
Cancel any month.
- Sixty apps
- Forty fixes a month (80 fix credits)
- Reports under your agency's name
- Slack alerts (set up with us)
Read-only, scoped, deleted.
We scan with read access and nothing else. Active probes against your live app run only after you have proven you own it.
Optional connections — a database role, a Supabase token, Vercel, Stripe — are scoped, used for the scan, and never stored in our database.
Your code is scanned in an isolated sandbox and deleted afterwards. Where we enable AI-assisted analysis for your organisation, selected source files and code excerpts are sent to our AI provider, Together. Naqqad does not use your code or findings to train AI models. Our AI provider, Together, is configured not to store prompts or responses, not to use them for training, and not to pass them to other model providers.
Your source never persists outside the scan sandbox. Snippets stored with findings are at most ten lines and pass a redactor.
We never run your application against live data. To verify a fix, we run your project's own install and tests inside an isolated sandbox with no access to your systems.
What we keep: findings, evidence excerpts, and reports, under a retention policy you can see. What we sell: audits and monitoring. What we don't: your data.