Lumkaro Security

Security · free scan

Is your AI-built app leaking data?

AI builders ship fast and often leave the locks off: secret keys in public code, databases anyone can read. Find out what's exposed in seconds, free.

  • Reads only what's already public
  • Never changes or downloads your data
  • No sign-up
EXAMPLE RESULTmy-bakery.lovable.app

Data exposed

2 urgent · 1 to fix · 6 passed

  • Urgent

    Database readable by anyone

    Your customers table answers without a login.

  • Urgent

    OpenAI secret key in public code

    sk-proj… in /assets/index-4f2a.js

  • Fix

    Full source code published

    Source maps let anyone rebuild your code.

What the scan looks for

The leaks AI builders leave behind most

Secret keys in public code

Stripe, OpenAI, Anthropic, AWS and Supabase service keys bundled into the code every visitor downloads.

Databases anyone can read

Supabase tables without Row Level Security, and Firebase rules left open to everyone. Checked once you show the app is yours.

Open file storage

Storage buckets that list every uploaded file, from invoices to ID photos.

Files that shouldn't be public

.env settings files and .git folders that hand out passwords, keys and your code history.

Your source code

Source maps published with your app let anyone rebuild your code, including how it reaches your data.

Browser protections

HTTPS and the security headers that block common script, framing and downgrade attacks.

Logins, roles, API routes and payment webhooks need someone to read the code. That's what Deep Review is for.

Found a leak?

We lock it down and prove it

  1. 01

    Scan

    Run the free scan, or send us your app and we'll run it with you.

  2. 02

    Lock

    We switch on database rules table by table, and close open storage and files.

  3. 03

    Rotate

    Every exposed key is replaced, the old one switched off, and secrets moved to the server.

  4. 04

    Prove

    We re-scan and send a clean report you can show your team or your clients.

Security plans

Fix it once, then keep it locked

Watch

Stay locked after every change.

$39/mo
  • Scan every week and after every deploy
  • Email alert when a key leaks or a table opens
  • Monthly report in plain English
  • Included in Ship Premium
Start Watch

Lockdown

Most chosen

For a leak the scan found.

$249

One-time

  • Database rules switched on, table by table
  • Exposed keys replaced and moved to the server
  • Open storage, files and source maps closed
  • Security headers and HTTPS fixed
  • Clean re-scan report to prove it
  • Up to 4 development hours
Lock it down

Deep Review

Before launch, payments or sensitive data.

from$599

One-time, quoted first

  • Everything in Lockdown
  • Code review of logins, roles and who sees what
  • API routes, payment webhooks and uploads checked
  • Written report, ranked by risk
  • Up to 8 development hours of fixes
Book a review

Work beyond the included hours is $75 an hour, quoted before we start. Hosting and database fees stay with your providers, in your name. We fix what we find; no one can honestly guarantee an app is unbreakable.

Security questions

Is the scan safe to run on my app?

Yes. It reads only what any visitor's browser can already reach, and never logs in or changes anything. Database and storage checks run only after you add a verification tag to your site, and even then we count rows, we don't read them.

Why do you need me to verify my app?

Checking whether a database is open means asking it for data. We only do that for apps whose owners say yes, by placing a tag only they can add. It keeps the scan from being used on other people's apps.

A key already leaked. What now?

Assume it's been copied. Replacing it and switching the old one off is the first thing we do in Lockdown, then we move it to the server so it can't leak again.

Do you need my passwords?

Never. You invite us to Supabase, Firebase or your hosting with a limited role, and remove us when we're done.

Can you guarantee my app is secure?

No one honestly can. We close the problems we find, show you a clean re-scan, and tell you plainly what's left.

Which tools do you work with?

Lovable, Bolt, Replit, v0, Cursor and hand-written code, on Supabase, Firebase, Vercel, Netlify and Cloudflare.

Find out before someone else does.

Free, takes seconds, no sign-up.

Scan my app