Scan any HTTPS site free. Create an account, verify your domain, then get your score.

Built for vibe-coded apps

Ship without surprises.

Create a free account, verify your domain, and get your security score in minutes.

HTTPS URLs only · Free account · Verify domain ownership before scanning

Already have an account? Sign in

app.repofort.dev/dashboard

Search projects, findings…

Overview

Security posture

+ New scan

Avg score

54D

Needs work · 3 fixes to a C

Open high

3 critical also open

Scans used

12/ 100

this period

Needs attention

View all

Supabase RLS disabled on 3 tables

my-saas-app

Critical

Stripe webhook has no signature check

my-saas-app

Critical

/api/seed returns 200 in production

acme-portal

Critical

Server action writes without auth

my-saas-app

High

Open by severity

Critical

High

Medium

Low

Score trend

+16 in 30d

Scan complete

9 findings · 3 critical · 48s

security checks

Finds the vulnerabilities your AI assistant ships, and never flags.

A–F

grading

Plain letter grade so you know your risk before you ship.

<60s

results

Paste a URL and get a full report in under a minute.

installs

No CLI, no GitHub app. Verify your domain and start scanning.

What we check

The security gaps AI
assistants leave behind.

Critical

Supabase RLS not enabled

Tables without Row Level Security expose all user data via the public API.

Critical

Stripe webhook unverified

No signature check means anyone can fake a payment and trigger order fulfillment.

High

Server action without auth

Next.js server actions that mutate the database without checking the session.

High

Missing ownership checks

Update and delete operations that don't verify the record belongs to the caller.

Medium

Insecure cookie flags

Cookies set without Secure, HttpOnly, or SameSite=Strict attributes.

Medium

Error message leakage

API routes that return error.message, leaking file paths and table names.

View all 57 security checks →

How it works

From zero to secured
in under a minute.

01 · CONNECT

Connect your project

Paste your GitHub repo URL, your live site URL, or both. No installs, no tokens required.

Your site URL

https://my-saas-app.vercel.app

Scan now →

02 · SCAN

Watch the scan run

Our engine checks your code for secrets and auth gaps, and probes your live site for misconfigurations.

Scanning…73%

✓ Checking auth routes
✓ Supabase RLS policies
· HTTP headers…

03 · FIX

Ship the fixes

Every finding comes with a code fix AND a ready-to-paste prompt for Cursor, Claude Code, or Windsurf. Your agent applies it, you don't have to.

Score 54/100Grade D

RLS disabledCritical

No CSP headerHigh

→ View fix guide

Your security report

Plain English.
Not a CVE dump.

Every finding tells you what the vulnerability is, what an attacker could do, and exactly how to fix it, written for builders, not security researchers.

Security score from 0–100 with a letter grade
Findings sorted by what matters most right now
Copy-paste code fixes you can ship in minutes
Agent-ready fix prompts for Cursor, Claude Code, and Windsurf
Separate code scan and live site scan results

Get your free report →

Security Report

my-saas-app.vercel.app · Grade D · 9 findings

54/100

Critical

High

Medium

Low

Info

Supabase RLS disabled: users can read all rows

Copy for agentCritical

Stripe webhook has no signature verification

Critical

/api/seed returns 200 in production

Critical

Server action writes to DB without auth

High

Missing Content-Security-Policy header

High

Built for the vibe-coding stack

Next.jsSupabaseVercelStripePrismaClerkOpenAIResendTailwindshadcn/ui

Don't ship
unsecured.

Paste your URL above. We'll create your project, guide you through domain verification, and run your first scan automatically.

Get started →

No install · Results in 60s · Plain English reports

Ship without surprises.

The security gaps AIassistants leave behind.

From zero to securedin under a minute.

Connect your project

Watch the scan run

Ship the fixes

Plain English.Not a CVE dump.

Don't shipunsecured.

Simple, transparent pricing.

The security gaps AI
assistants leave behind.

From zero to secured
in under a minute.

Plain English.
Not a CVE dump.

Don't ship
unsecured.