Scanfull opens your live app like any visitor would, finds what was left exposed, and proves every flaw. Then it hands you the ready-made prompt for your assistant to fix it — and comes back to confirm it was done.
Only use on apps you own or are authorized to test. Never put a password or token in the URL.
1281import { createClient } from "@supabase/supabase-js"1282// gerado automaticamente — não editar1283const url = "https://xyzcompany.supabase.co"1284const db = createClient(url, "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9")1285// role: service_role · ignora toda a RLSWe analyze the published app — the tool that generated the code doesn't matter
What can a stranger do beyond what you planned for?
When a private credential ends up in the code the browser downloads, it stops being yours. Whoever opens the file starts spending on your account.
GET /assets/index-4f2b.js → 200 · sk_live_4eC3••••
With Row Level Security off, the same call that returns your orders returns everyone's. The app works the same — the leak is silent.
GET /rest/v1/orders (no session) → 200 · 3,418 rows
Environment files, backups, and code directories stay served by the server because no one told it to block them.
GET /.env → 200 · 1.2 KB
Without published SPF and DMARC, a stranger sends phishing signed with your domain. Your customer pays the trust bill.
TXT _dmarc.your-domain.com → not found
Almost no one wakes up set on attacking your system. What exists is automated scanning, all day, looking for the same handful of slips on every address that answers. You don't have to be a target — you just have to be online.
230 million
targets swept by a single campaign
An extortion operation collected .env files from around 110,000 domains and used the breached machines to scan the internet for more. Nobody chose those victims: they just answered.
Unit 42, Palo Alto Networks · 202422 minutes
between a flaw going public and the first attempt
That was the gap measured between a proof-of-concept being published and the first real attack using it. Not time to react afterward — time to already be closed before.
Cloudflare, State of Application Security · 2024170 of 1,645
apps from Lovable's own showcase with an open database
A researcher swept the official gallery and found 10% with row-level protection off. You could read the name, email, phone, address, and debt amount of real people.
CVE-2025-48757 · Matt PalmerReads the users table
Your customers' names, emails, phones, and addresses, all at once, with a request any browser makes.
Writes to it
With no row rule, reading and writing are the same permission. You can edit your own record and become a paying subscriber without paying.
Spends on your account
With the API key in the bundle, the usage is theirs and the bill is yours — and you only find out at month-end.
None of these takes talent. It takes an open door — and the scan that finds the door is the same for everyone. That's why closing this layer takes your app off the automatic target list, which is where nearly every incident in a new app comes from.
Any scanner finds a key that looks like a key. The question that decides whether you have to wake up at 3 a.m. is a different one: does it work?
Surface scanner
“We found a credential that appears to be private. Validity not verified. Confidence: to be confirmed.”
You get a suspicion and the job of investigating it alone.
Scanfull
“We used the key. It opened 3 tables with no authentication and returned 3,418 records — including customer email and address.”
You get a fact, with the list of tables that opened.
The test that truly interacts with your system only runs after you prove you own the domain. Without that, it would be intrusion testing on someone else's site — and we don't do that even when asked.
Four steps. The third is free and the fourth is what almost no one delivers.
No signup, no card, nothing to install. Just your app’s public URL.
It’s not a curl looking at a header. It’s Chromium crawling up to 120 pages, reading the bundles, storage, cookies, and the domain’s DNS. It takes a few minutes, and that’s why it finds what it finds.
Free, with the prioritized action plan: what to fix today, how long it takes, and how much risk comes off.
The full report opens where each flaw is and the ready-made prompt. Then the retest confirms it live — and that’s included.
The finding, the proof behind it, the fix, and the confirmation — in that order, because that’s the order you need to act in.
Verdict
Three critical findings put the database and the API account within reach of any visitor — and three criticals zero the score. The app is live and working: that’s what keeps anyone from noticing.
Action plan: the first block takes ~1h40 and removes 89% of the risk.
63 types of check across 11 families, each classified by OWASP Top 10 and CWE. Each type runs against every page, every file, and every header your app serves — your report shows how many checks actually ran.
Stripe, OpenAI, Anthropic, AWS, Google, GitHub, PEM keys — and the Supabase service_role, which bypasses all RLS.
Active test: we try to read your tables with no authentication. If a row comes back, the database is open — and we count how many.
.env, .git and config backups served publicly. A secret one click away, no technique required.
CSP, HSTS, clickjacking, nosniff, Referrer-Policy, and the session cookie flags.
Missing redirect, expiring certificate, obsolete TLS, and HTTP resources inside an HTTPS page.
Wildcard origin (with and without credentials) and a session token stored where any script can reach it.
Missing SPF and DMARC — the gap almost no app scanner looks at, and that turns into phishing in your name.
jQuery, lodash, axios, Handlebars and others: we cross the version your site loads against public flaws already patched.
Every finding ships with OWASP Top 10, CWE, an effort estimate, and a data-protection flag when personal data is at risk.
For half of it, you can — and we won’t pretend otherwise. If the report says a security header is missing, paste it into your assistant and it’s solved. That’s why the scan and the list of flaws are free.
What it can’t do is look at your live app. It doesn’t know which key leaked or in which file inside a one-megabyte bundle. It doesn’t know which tables in your database answer without authentication. And above all, it has no way to confirm the fix landed in production — it thinks it fixed it, which is not the same thing.
That’s the difference we charge for: proof of where it is, and proof that it’s done.
You pay for how deep you want to go — each level includes the one before. One-time payment, no plan, no subscription.
Free scan · $0 — no signup, no card
A 0-to-100 score for your app · The full list of flaws, by severity · OWASP, CWE and data-protection classification · Prioritized action plan, with time estimates
$19.90 / site
The home and every public page — plus everything the browser downloads (bundles, configs). That is where most AI-built app leaks show up.
$49.90 / site
Everything in Public plus the logged-in user area. You create a test account; we run it in an isolated session and wipe it afterward.
$99.90 / site
The complete audit: everything in the levels below plus the admin panel and the most valuable test of all.
The first scan is free — you only pay if you want the proof and the fix.
The moment the app stops being just yours is the moment its surface starts to matter to a stranger.
Permissions, sessions, and integrations are exactly where the code assistant improvises when you’re not looking.
A report with evidence and a retest changes the conversation: you deliver software with an audit, not a promise.
The surface changes with the code. What was closed last week may have reopened yesterday.
Scope, security, fixing, and billing — no fine print.
No. Scanfull looks at the published app, from the outside, like any visitor would: it opens the pages in a real browser, reads the files the site serves, and checks the domain’s DNS. No plugin, no SDK, no repository access, and not a single line changed in your project.
It writes nothing. The surface checks only observe responses. The checks that truly interact with the system — like the RLS test — only run after you prove you own the domain, and even then they are read-only.
It works, and that’s exactly the case Scanfull was built for. Because we analyze what’s published, the tool that generated the code doesn’t matter. What changes is the output: the fix prompt comes in the format of the assistant you use.
For the easy ones, it can — and that’s fine, the free scan exists for that. What your AI can’t do is look at the live app: it doesn’t know which key leaked or in which file, doesn’t know which database tables are open, and can’t confirm the fix landed in production. That’s what we sell.
The location of each flaw with the evidence, the root cause and impact, before/after code, the fix prompt for your assistant, the instruction on how to verify it’s done, the retest included, and the report exportable to Markdown or PDF.
After fixing, you trigger the second pass on the same address. We compare finding by finding by each one’s fingerprint and tell you what left the list, what remains, and what appeared afterward. It’s included in what you paid, within seven days.
Never in clear text. As soon as a secret is detected, it’s masked before anything is stored — what stays in the database is the masked version and a hash, used to recognize the same key in a future scan. This is a product rule, verified by an automated test and by a constraint in the database itself.
Only with their authorization. The surface part is what any visitor sees, but the checks that interact with the system require domain verification precisely so no one tests what they shouldn’t. If you’re an agency or software house, verify the domain together with the client and the report comes out ready to hand over.
Finding out later usually costs the client who trusted you.
scanfull