Scan, cite, fix, watch.

Every finding cites evidence. Static engines: Opengrep, OSV-Scanner (offline), Betterleaks, plus stack checks. Source is deleted at the end of the scan.

What gets scanned

Static engines, schema replay, and — with your say-so — live probes, in an isolated sandbox. Read-only, and your source is deleted after the scan.

• Supabase RLS — a table readable without a session, proven by the query we ran
• Keys & secrets — a service-role key in client code, with the file and line
• Stripe — a webhook handler that never verifies the signature
• Auth — a password reset flow that leaks whether an email exists
• API — a server action with no auth check inside its boundary
• Performance — a 4 MB bundle measured five times, median reported
• Cost — a column that averages 4 KB per row, priced at your tier
• Ops — no backups on the database your business runs on

The evidence standard

Each finding carries a location and a measured-or-estimated label. The query we ran, the answer we got. No evidence, no finding.

Source deletion

We scan with read access and nothing else. Active probes against your live app run only after you have proven you own it.

Your source never persists outside the scan sandbox. Snippets stored with findings are at most ten lines and pass a redactor.

We never run your application against live data. To verify a fix, we run your project's own install and tests inside an isolated sandbox with no access to your systems.