Question 1

What does Decloak actually check?

Accepted Answer

Eight core layers run on every scan, free tier included: HTTP and TLS security posture, static HTML analysis, rendered-page network behaviour, JavaScript CVE scanning, tag manager intelligence, third-party domain mapping, vibe-coded platform security (Supabase, Lovable, Base44, Bubble, and Next.js misconfigurations), and an AI-written executive summary that ties the findings together. Enterprise adds a ninth layer of active security testing (DAST); Starter and up add a tenth layer for DNS records, TLS certificate analysis, and subdomain discovery. See the How it works page for the full breakdown.

Question 2

Do I need an account to scan a site?

Accepted Answer

No. The free scan works on any URL with no login - paste it in and get a graded, shareable report in about 15 seconds. Creating a free account lets you save scans, see a dashboard across domains, and get a higher daily scan limit.

Question 3

Can I scan any website, including ones I don’t own?

Accepted Answer

Decloak's free, Starter, and Pro scans perform passive, read-only analysis of publicly accessible pages - the same information any visitor’s browser receives. Enterprise's opt-in Active Security Testing goes further with safe, non-destructive active probes (forced browsing, CORS checks, reflected-input canaries) - it requires explicit per-scan consent, since it actively probes the target rather than just observing it. Either way, Decloak does not attempt exploitation or authentication bypass, and you’re responsible for having the right to scan a given target under your local laws and any applicable terms of service.

Question 4

What’s the difference between the free scan and the paid investigation?

Accepted Answer

The free scan runs the core 8 layers once, on the single page you submit - including a check for Supabase, Lovable, Base44, Bubble, and Next.js misconfigurations. Paid tiers deploy an AI agent that keeps crawling and investigating - following scripts, source maps, tag manager containers, and linked pages - across up to 50 pages on Starter, 200 on Pro or Enterprise, then produce per-finding remediation guidance. Enterprise also adds active security testing (DAST) and authenticated scans behind a login.

Question 5

Can I trigger scans programmatically, or from an AI agent?

Accepted Answer

Yes, on Pro and up. A REST API with OpenAPI/Swagger docs lets you trigger scans and poll results from your own tooling, and an MCP server lets Claude, Cursor, or any MCP-compatible AI agent do the same directly. Slack notifications and signed webhooks are also available. See the Integrations page for details.

Question 6

What is "vibe-coded platform security" checking for?

Accepted Answer

AI app builders and no-code platforms - Lovable, Supabase used directly, Base44, Bubble, and similar - make it fast to ship an app, but they also make it easy to ship the same handful of recurring security mistakes. Decloak fingerprints which of these platforms a site is built on, then checks for the specific misconfigurations most commonly reported for that stack: a Supabase database left publicly readable because Row Level Security was never enabled, a Supabase service_role key accidentally shipped in client-side JavaScript, a Bubble Data API left open with no privacy rules, and known platform vulnerabilities like the Next.js middleware authorization bypass (CVE-2025-29927).

Question 7

My site wasn't built with an AI app builder - does this check still run?

Accepted Answer

Yes, it runs on every scan regardless of how the site was built. If no known platform signature is detected, it simply reports "no known AI-builder platform signature found" as an informational, clean result - it never counts against your score.

Question 8

How does Decloak find a publicly readable database without my login?

Accepted Answer

It doesn't need one. A Supabase project's "anon" API key is meant to be public - it ships in your own site's JavaScript by design, and Row Level Security (RLS) is what's supposed to restrict what that key can read on a row-by-row basis. Decloak extracts the anon key and project URL your own site already exposes to every visitor, then checks a short list of common table names read-only - the same thing anyone else with your public key could do. If a table responds with data, RLS isn't configured correctly for it.

Question 9

Does the report show real records from my database?

Accepted Answer

No. If a table is found to be publicly readable, the finding shows the table name, how many rows came back, and the field names present (e.g. "email, password_hash") - never the actual field values. That's enough to show the exposure is real without Decloak's own systems ending up storing a copy of your users' data.

Question 10

I fixed an exposed table - will Decloak know?

Accepted Answer

Re-scan the site and the check will re-run and come back clean. On Starter plans and up, this check also runs automatically on every scheduled recurring scan, so you'll get alerted if a table becomes exposed again after a future deploy - not just when you remember to check manually.

Question 11

How accurate are the findings?

Accepted Answer

JavaScript and server CVE findings are matched against known vulnerability databases (Retire.js and NVD) with linked CVE IDs, so those are high-confidence. Configuration and behaviour findings (missing headers, third-party scripts, cookie flags) are based on direct observation of what the page actually sent or loaded. The AI executive summary is generated from those findings and should be read as a synthesis, not an independent source of truth.

Question 12

Can a finding be a false positive?

Accepted Answer

It’s possible, particularly for behavioural findings that depend on context Decloak can’t fully see (e.g. a script pattern that looks risky but is intentional). CVE findings tied to a specific library version are the least likely to be wrong. If something looks off, the evidence shown with each finding is exactly what was observed - check it against the source directly.

Question 13

Does a low grade mean my site is unsafe?

Accepted Answer

The grade reflects the security posture Decloak could observe from the outside - missing hardening, outdated libraries, exposed configuration. It’s a strong signal for prioritising fixes, not a certification of overall safety or a substitute for a full penetration test.

Question 14

Is my scan report public?

Accepted Answer

Free-tier reports get a shareable public link by design, so you can send a report to a colleague without them needing an account. Paid (agent) scan reports are private to your account by default - you can turn on a shareable link, or email a copy directly, from the "Share" button on the report page. See the Privacy Policy for full detail.

Question 15

Do you store the pages you scan?

Accepted Answer

Decloak stores the findings, evidence snippets, and metadata produced by a scan (e.g. header values, script URLs, detected library versions) so the report can be viewed later and compared against future scans. It does not archive a full copy of the target site.

Question 16

What happens to my data if I delete my account?

Accepted Answer

Deleting your account removes your saved scans and personal data per the retention terms in the Privacy Policy. Contact support@decloak.dev if you need this done manually.

Question 17

What plans are available?

Accepted Answer

Free (single-page scan, no account needed), Starter at £29/month (AI agent investigation, up to 50 pages per scan), Pro at £79/month (up to 200 pages, compliance mapping, team features), and Enterprise at £99/month (adds active security testing/DAST and authenticated scans behind a login). Full comparison is on the pricing section of the homepage.

Question 18

Can I cancel or change my plan anytime?

Accepted Answer

Yes. Billing is self-service through the Stripe customer portal, linked from Account Settings - switch plans, update your payment method, or cancel without contacting support.

Question 19

Do you offer refunds?

Accepted Answer

Reach out to support@decloak.dev if something went wrong with a charge and we’ll sort it out on a case-by-case basis.

Frequently asked
questions.

Getting started

Vibe-coded platform security

Findings and accuracy

Data and privacy

Billing

Try it yourself. It's free.

Frequently askedquestions.