Free · No account · Results in 15 seconds
Automated web security intelligence
for vibe coders, small businesses, compliance teams, agencies, solo builders, security teams, MSPs
Decloak scans 8 attack surfaces simultaneously - JavaScript CVEs, hidden trackers, third-party data flows, DNS/TLS posture, subdomains, security headers, vibe-coded platform security, CMS detection and checking - and delivers a scored, graded report in under 15 seconds.
Security Score
Fair - attention needed
example.com
just now
Supabase database publicly readable via anon key
GET /rest/v1/users?select=* -> 200, 3 rows
Stripe API key exposed in /dist/main.js
sk_live_4xK9mR...
jQuery 1.12.4 - CVE-2019-11358
Known XSS vulnerability - 3 pages affected
GTM firing 3 tags to unknown domains
cdn-analytics-2847.io · reg. 6 weeks ago
AI Summary
Critical credential exposure detected in production JS bundle. A recently-registered domain is loading third-party scripts that may have been compromised...
See it in action
From free scan to compliance evidence - in one video.
A two-minute walkthrough of the free scan, the AI agent investigation, and what changes when you need audit-ready evidence.
What Decloak finds
Your website is doing things you don't know about.
Eight attack surfaces, one scan - JavaScript CVEs, hidden trackers, exposed subdomains, DNS/TLS misconfigurations, publicly readable Supabase databases, and more. Most tools check one thing. Decloak correlates findings across every layer to surface risks single-purpose scanners miss.
Findings below marked Free come from the free single-page scan - Starter+ findings (subdomains, DNS/TLS) need a full agent scan.
Supabase database publicly readable via anon key
GET /rest/v1/users?select=* → 200, 3 rows
Stripe API key exposed in production bundle
sk_live_4xK9mRpQ2...
jQuery 1.12.4 - CVE-2019-11358 (XSS)
/assets/vendor.js · loaded on 3 pages
GTM firing to 3 unrecognised domains
cdn-analytics-2847.io · reg. 6 weeks ago
Content-Security-Policy header missing
No CSP policy found across 12 pages
Hidden 1×1 tracking pixel - doubleclick.net
<img width="1" height="1" style="display:none">
Source map exposed - /dist/app.js.map
Original source code reconstructable
Supabase service_role key exposed in client JS
Masked key: eyJhbGciOi...4kD9x2
Forgotten staging subdomain still live
staging.example.com · exposed admin login
TLS certificate expires in 4 days
issuer: Let's Encrypt · no auto-renewal detected
WordPress 6.2 - CVE-2023-2745 (Directory Traversal)
wp-includes/version.php · plugin/theme fingerprinting also run against Shopify, Magento, and 15+ other platforms
Free tier · Built with AI
Shipped it fast?
We check what got skipped.
Apps built with Lovable, Supabase, Base44, Bubble, and similar AI app builders share the same handful of recurring security failures - most famously, a Supabase database left publicly readable because Row Level Security was never turned on. Decloak fingerprints your stack and checks for the specific misconfigurations reported for it, on every scan, free tier included.
See vibe-coder featuresPublicly readable database detection
Checks whether your Supabase tables can be read by anyone using your own public anon API key - the single most common security failure in AI-app-builder projects.
Exposed service_role key detection
Flags a leaked Supabase service_role key sitting in your client-side JavaScript before an attacker finds it - that key bypasses Row Level Security entirely.
Platform fingerprinting
Automatically detects Lovable, Supabase, Base44, Bubble, and Next.js - no configuration needed, no platform to select.
Known platform CVEs
Checks for named, high-impact vulnerabilities like the Next.js middleware authorization bypass (CVE-2025-29927).
Who it's for
One scanner. Four very different jobs.
From a five-minute sanity check on a weekend project to monthly audit evidence across a whole client portfolio.
Vibe coders & solo builders
Shipped fast with AI and skipped the security review? Paste your URL and see exposed keys, missing headers, and vulnerable libraries before your users find them.
Scan your app freeSmall & growing businesses
Scheduled scans, DNS/TLS checks, and forgotten-subdomain discovery - real security posture without an enterprise scanner budget.
See what you getCompliance & security teams
SOC2, ISO 27001, NIS2, and DORA evidence, mapped automatically, plus Enterprise-tier Active Security Testing (DAST) with an independent score.
View compliance featuresAgencies & MSPs
One dashboard across every client domain - subdomain discovery, DNS/TLS posture, and team seats so the whole account team can see it.
See team featuresFree scan
Free scan: three steps. Fifteen seconds.
This is the free, single-page tier - no account needed. Want full-site coverage? That's the paid agent investigation below.
Paste any URL
No account, no setup, no browser extension. Just a URL. Free tier results in under 15 seconds.
AI scans 8 attack surfaces
HTTP headers, HTML, live network traffic, JavaScript CVEs, tag managers, third-party supply chain, vibe-coded platform misconfigurations, CMS/platform fingerprinting, and behavioural analysis - simultaneously.
Get your scored report
A graded A–F report with an AI-written executive summary. Shareable by link. Readable by anyone.
Full agent scan · Starter and up
Full agent intelligence:
It doesn't scan. It investigates.
The free tier scans one page. Paid plans deploy an AI security agent that reads each finding and decides what to look at next - following threads, fetching scripts, checking domains - until it has complete site coverage.
- Reads findings and decides what to investigate next
- Fetches and scans every identified JavaScript file
- Checks domains against threat intelligence databases
- Reconstructs source code from exposed source maps
- Produces per-finding remediation guidance
- Shows its reasoning at every step
For compliance teams
Replace your compliance scanner.
Teams using AppCheck, Qualys, or Tenable for monthly SOC2 and ISO 27001 evidence pay thousands per year for reports that still need a pentester to interpret. Decloak delivers the same scheduled scan cadence, maps findings to SOC2, ISO 27001, NIS2, and DORA controls, and produces PDF evidence packages - at a fraction of the cost.
View compliance featuresScheduled recurring scans
Automated weekly, monthly, or quarterly cadence keeps your SOC2, ISO 27001, NIS2, and DORA evidence current without manual effort.
PDF evidence packages
Timestamped, exportable PDFs with a scan attestation block, formatted for evidence review.
ISO 27001 / SOC2 / NIS2 / DORA mapping
Findings automatically tagged to ISO 27001 Annex A controls, SOC2 Trust Services Criteria, NIS2 Article 21 measures, and DORA ICT-risk articles.
Scan history and comparison
Compare each scan against the last - show auditors exactly which findings have been resolved.
Remediation tracking
Mark findings as Open, In Progress, Resolved, or Accepted Risk. Auditors need to see action was taken.
Multi-domain dashboard
One view across all your domains - current grade, last scan date, and open critical findings.
Audit activity log
A per-domain log of every scan, deletion, and finding change - who did it and when, ready for change-control evidence.
Enterprise
Go beyond observation.
Actively test it.
Enterprise scans add safe, non-destructive active probes on top of the full investigation - forced browsing, CORS misconfiguration checks, reflected-input canaries, and authenticated scans behind a real login. Results roll up into an independent Active Testing Score and a standalone, boardroom-ready DAST report.
See Active Testing featuresActive Security Testing (DAST)
Forced browsing, CORS misconfiguration probes, HTTP method checks, and postMessage handler auditing - beyond passive observation.
Independent Active Testing Score
A dedicated grade for what was actively probed, shown alongside your regular security score.
Authenticated scan mode
Capture a logged-in session via our browser extension - the only path that works for passkey/WebAuthn auth.
Executive DAST report (PDF)
A standalone, boardroom-ready PDF scoped to Active Testing results - severity breakdown and a full "what we tested" checklist.
Starter and up
1,000 findings. 7 things to fix first.
A full scan can surface hundreds of findings - useful for coverage, useless for a Monday morning to-do list. The Priority Remediation Plan collapses duplicates, ranks what's left by severity, and hands you a top-25 fix list in plain English, exportable as a PDF you can send straight to a client or developer without them ever opening the full report.
See Priority Remediation Plan featuresTop 25, ranked
Every finding scored by severity, then whether a CVE is involved, then how long it has sat open - so the list is always "fix this first," not just "everything we found."
Plain-English AI guidance
Each item comes with specific, actionable remediation advice - not a CVE ID and a shrug.
Client-ready PDF export
Hand a finished plan straight to a client or developer - no one has to click into individual findings to know what to do next.
Status & assignment tracking
Mark items Open, In Progress, or Resolved and assign them to a teammate, right from the plan - a Pro-plan upgrade on top of Starter.
Pricing
Start free. Scale when you need to.
Free for individual page checks. Paid plans unlock full AI agent investigations, scheduled scans, and compliance reporting - at a fraction of enterprise scanner costs.
Free
- 1-page scan per submission
- All 8 scan layers
- Vibe-coded platform security scan (Supabase, Lovable, Base44 & more)
- AI executive summary
- Scan history in your account
- Re-scan and delete anytime
- Shareable public link
Starter
- Full AI agent investigation
- Up to 50 pages per scan
- Per-finding remediation guidance
- Priority Remediation Plan (top fixes, AI-written, exportable PDF)
- AI assistant chat
- DNS & SSL/TLS security analysis
- PDF evidence export
- Scheduled recurring scans
- Scan comparison reports
- Email alerts for new criticals
Pro
- Everything in Starter
- Up to 200 pages per scan
- ISO 27001 / SOC2 / NIS2 / DORA control mapping
- Remediation tracking
- Team access and finding assignment
- Slack and webhook notifications
- API access
- Audit evidence packages
- Audit activity log
- White-label PDF branding
Enterprise
- Everything in Pro
- Active Security Testing (DAST)
- Independent Active Testing Score
- Forced browsing, CORS, reflected-input probes
- Authenticated scan mode (session capture)
- Enable active testing via API / MCP
- Priority support
The Decloak Journal
Security news & platform updates.
Stories from around the web security world, plus release notes and changes to Decloak itself.
Meet the Decloak AI Assistant: It Already Knows Which Scan You're Looking At
A chat widget lives in the bottom-right corner of every page now. For free accounts it's a curated FAQ router. For paid plans it's a scan-aware agent that can pull your actual findings, look up a real CVE, and explain a compliance control, without you leaving the report.
Uncloaked: A Misconfigured Cloud Server, a SharePoint Zero-Day, and 29 Million Leaked Secrets
Four stories from the last few weeks: a Nextcloud misconfiguration that exposed 367,000 files, a Salesforce webpage misconfiguration behind a 13.5-million-record breach, an actively exploited SharePoint zero-day, and the year's secrets sprawl numbers.
Access-Control-Allow-Origin: * Feels Like a Convenience. It's Usually a Vulnerability.
CORS errors are annoying enough during development that a lot of teams silence them permanently with a wildcard. That single header change quietly opens your API to any website on the internet that wants to make requests on a logged-in user's behalf.
Compliance Mapping Now Covers NIS2 and DORA, Not Just SOC 2 and ISO 27001
Every finding Decloak detects is now mapped to NIS2 and DORA controls alongside SOC 2 and ISO 27001. Same 36 finding categories, same underlying scan, two more frameworks to help you get ahead of this October's NIS2 deadline.