# Unspill

> Unspill is a free, passive security scanner for apps built with Lovable, Bolt, v0, Cursor and Replit. Paste your URL to find leaked API keys, exposed .env files, public source maps, missing security headers and Supabase RLS risks, with plain-English fixes.

Unspill is a free, no-signup, passive (read-only) security scanner for web apps built with AI app builders such as Lovable, Bolt, v0, Cursor and Replit, typically on Supabase, Firebase, Stripe and Vercel. A user pastes the public URL of an app they own; Unspill fetches only public resources (HTML, JavaScript bundles, public source maps, /.env, /.git/config, one CORS preflight) and returns a graded report (A to F, 0-100) with plain-English fix steps. It never queries the app's database and never stores reports or secrets; found secrets are masked.

## Key pages
- [Free scanner](https://unspill-scan.vercel.app/): paste a URL, get a report in under 30 seconds
- [How it works](https://unspill-scan.vercel.app/how-it-works): exact requests, limits, scoring, what a passive scan can't see
- [Fix guides index](https://unspill-scan.vercel.app/fix)
- [Fix Service](https://unspill-scan.vercel.app/fix-service): planned Fix Pack ($119 during the launch sale, normally $149; one app: keys moved server-side, headers, source maps, RLS for up to 10 tables, re-scan) and Deep Audit ($279 during the launch sale, normally $349: code, database rules, auth/user-to-user access tests, written report, 30-day re-check). Launch sale: 20% off planned prices through Nov 30, 2026, for anyone who joins the waitlist before then. Opening soon; waitlist only, no payment taken.
- [Monitor](https://unspill-scan.vercel.app/monitor): planned re-scan after every deploy plus weekly, with email alerts; $15/month for 1 app (normally $19), $39/month for 5 apps (normally $49) during the launch sale through Nov 30, 2026. Opening soon; waitlist only.
- [Free fix review](https://unspill-scan.vercel.app/free-review): free review of your fixes for the first 5 people who scan, in exchange for an honest testimonial; nothing for sale, no payment details asked.
- [Sample report](https://unspill-scan.vercel.app/sample-report): a real Unspill scan of our own test app (unspill-fixture.vercel.app), which has fake secrets planted on purpose, so you can see what a report looks like before scanning your own app.
- Deep link: https://unspill-scan.vercel.app/?scan=yourapp.com prefills the scan field. It never starts a scan by itself; the person must confirm they own the app.
- Badge: every signed share link (/report?...&sig=...) has an "Add badge to your site" box. The SVG at /api/badge?<same params> shows the grade and scan date only when the signature is valid, and "unverified" otherwise.
- [Privacy](https://unspill-scan.vercel.app/privacy)

## Platform security checklists
- [Lovable app security checklist: 10 checks before you publish](https://unspill-scan.vercel.app/guides/lovable-security-checklist): A practical security checklist for apps built with Lovable: Supabase RLS policies, secret keys, edge functions, storage buckets, headers and what Lovable's built-in security scan does and doesn't cover.
- [Bolt.new security checklist: database, keys and Netlify settings](https://unspill-scan.vercel.app/guides/bolt-security-checklist): Security checklist for apps built with Bolt.new: Bolt Database vs Supabase, VITE_ environment variables, Netlify secrets, edge functions for Stripe, headers and source maps.
- [v0 and Next.js on Vercel: security checklist for AI-built apps](https://unspill-scan.vercel.app/guides/v0-nextjs-vercel-security-checklist): Security checklist for Next.js apps generated with v0 or Cursor and deployed on Vercel: NEXT_PUBLIC_ variables, server actions and route handlers, sensitive env vars, headers, deployment protection.
- [Supabase RLS check: copy-paste SQL to find exposed tables](https://unspill-scan.vercel.app/guides/supabase-rls-check): Six copy-paste SQL queries to find Supabase tables without Row Level Security, policies that allow everyone, public storage buckets, RLS-bypassing views and SECURITY DEFINER functions, plus owner-only policy templates.
- [Firebase Security Rules checklist for AI-built apps](https://unspill-scan.vercel.app/guides/firebase-security-rules-checklist): Checklist for Firestore, Realtime Database and Cloud Storage rules in AI-built Firebase apps: test-mode rules, request.auth checks, ownership, App Check and testing with the emulator.
- [Is my Stripe secret key exposed? How to check in 2 minutes](https://unspill-scan.vercel.app/guides/is-my-stripe-secret-key-exposed): How to check whether your Stripe secret key (sk_live_), restricted key (rk_) or webhook secret (whsec_) is exposed in your app's front-end code, and what to do if it is.
- [Replit app security checklist: Secrets, Security Center and publishing](https://unspill-scan.vercel.app/guides/replit-security-checklist): Security checklist for apps built with Replit Agent: the Secrets tool vs configurations, production app secrets, Security Center scan levels, blocking publishing on critical findings, app access and database access rules.
- [Cursor-built app security checklist: keys, .cursorignore and what to review](https://unspill-scan.vercel.app/guides/cursor-app-security-checklist): Security checklist for apps built with Cursor: keep .env files out of the agent's context with .cursorignore, keep secrets out of client bundles (NEXT_PUBLIC_/VITE_), review auth on generated API routes, and scan before you ship.
- [Exposed OpenAI API key? What to do in the next 10 minutes](https://unspill-scan.vercel.app/guides/exposed-openai-api-key): Your OpenAI API key (sk-proj-...) is in your front-end code, a public repo or a screenshot. Rotate it, check usage, set project spend limits, move calls server-side and prevent it happening again.
- [Supabase anon key vs service_role key (and publishable vs secret keys)](https://unspill-scan.vercel.app/guides/supabase-anon-key-vs-service-role-key): Which Supabase key is safe in the browser? The anon / publishable (sb_publishable_) key is public and limited by RLS; the service_role / secret (sb_secret_) key bypasses RLS and must stay on the server. How to tell them apart and what to do if one leaks.
- [Is my Firebase API key a secret? (And when a Google key is a real leak)](https://unspill-scan.vercel.app/guides/is-my-firebase-api-key-secret): Your Firebase web apiKey is public by design and safe in client code, as long as it's restricted to Firebase APIs and your data is protected by Security Rules. A Gemini or other Google Cloud key in the same bundle is a real leak. How to tell them apart.
- [Supabase RLS disabled? How a table leaks through the anon key, and how to fix it](https://unspill-scan.vercel.app/guides/supabase-rls-disabled-data-leak): If a Supabase table in an exposed schema has Row Level Security disabled, anyone with your public anon/publishable key can read and write it through the Data API. How to check your own project, the SQL to fix it (enable RLS, revoke grants, add policies) and how to stop it happening to the next table.
- [Unspill vs Lovable Security Scan vs Supabase Security Advisor: what each one checks, and what it can't see](https://unspill-scan.vercel.app/guides/unspill-vs-lovable-security-scan-vs-supabase-advisor): An honest comparison of three free security checks for AI-built apps: Lovable's built-in Security Scan, Supabase's Security Advisor and Unspill's outside-in scan. What each one looks at, its blind spots, and when to use which. Sourced from the official docs.

## Fix guides
- [Supabase service_role key exposed in your app: how to fix it](https://unspill-scan.vercel.app/fix/supabase-service-role): A Supabase service_role (or sb_secret_) key in front-end code gives anyone full read/write access to your database, bypassing Row Level Security. Here is how to rotate it and fix the leak.
- [Supabase RLS check for Lovable, Bolt and v0 apps: a 2-minute self-test](https://unspill-scan.vercel.app/fix/supabase-rls): Your Supabase anon key is public by design, so Row Level Security is the only thing protecting your tables. Run these SQL checks to find tables with RLS off or policies that let anyone read everything.
- [Stripe secret key (sk_live) exposed in front-end code: how to fix it](https://unspill-scan.vercel.app/fix/stripe-secret): A Stripe sk_live_ or sk_test_ key in your JavaScript lets anyone create charges, issue refunds and read your customers. Roll the key in the Stripe Dashboard and move payments server-side.
- [OpenAI or Anthropic API key exposed in your app: how to fix it](https://unspill-scan.vercel.app/fix/ai-key): An OpenAI, Anthropic, Groq, OpenRouter or xAI key in your front-end bundle lets anyone run up your bill. Revoke it and proxy AI calls through a server function with rate limits.
- [AWS access key (AKIA) exposed in front-end code: how to fix it](https://unspill-scan.vercel.app/fix/aws-key): An AWS access key ID in your JavaScript usually ships with its secret. Deactivate it in IAM, check CloudTrail, and use presigned URLs or a server function instead.
- [Firebase service account / private key exposed in your app: how to fix it](https://unspill-scan.vercel.app/fix/private-key): A private key or Google service-account JSON in browser code gives admin access to Firebase/Google Cloud. Delete the key in Google Cloud IAM and use the Admin SDK only on a server.
- [GitHub, Slack, SendGrid, Resend or Twilio key exposed in your app](https://unspill-scan.vercel.app/fix/other-token): Service tokens in front-end code (GitHub, Slack, SendGrid, Resend, Twilio) can be used by anyone to act as your account. Revoke them and move the calls server-side.
- [Hard-coded secrets in JavaScript: how to find and remove them](https://unspill-scan.vercel.app/fix/generic-secret): Variables named secret, token, password or apiKey with long random values in front-end code are often real credentials. Check each one, rotate real secrets, and keep them server-side.
- [Your .env file is publicly accessible: how to fix it](https://unspill-scan.vercel.app/fix/exposed-env-file): If https://yourapp.com/.env downloads your environment file, every secret in it is public. Remove it from the deployed output, block dotfiles, and rotate every key.
- [Exposed .git folder on your website: how to fix it](https://unspill-scan.vercel.app/fix/exposed-git): A public /.git/config means attackers can often download your full source and commit history, including old secrets. Block /.git and rotate anything ever committed.
- [Public source maps expose your source code: how to disable them](https://unspill-scan.vercel.app/fix/public-source-maps): Production .map files let anyone rebuild your original front-end code, comments and internal routes. Disable them in Vite or Next.js, or upload them privately to your error tracker.
- [How to add a Content-Security-Policy to a vibe-coded app](https://unspill-scan.vercel.app/fix/missing-csp): A Content-Security-Policy limits which scripts can run on your site, reducing the damage of XSS. Copy-paste CSP examples for Vercel, Netlify and Next.js apps using Supabase.
- [How to enable HSTS (Strict-Transport-Security) on your app](https://unspill-scan.vercel.app/fix/missing-hsts): HSTS tells browsers to always use HTTPS for your domain, preventing downgrade attacks on public Wi-Fi. Add one header in vercel.json, _headers or next.config.js.
- [Prevent clickjacking: X-Frame-Options and frame-ancestors](https://unspill-scan.vercel.app/fix/clickjacking): If any site can load your app in an iframe, attackers can trick users into clicking buttons they can't see. Add X-Frame-Options: DENY or CSP frame-ancestors 'none'.
- [Add X-Content-Type-Options: nosniff](https://unspill-scan.vercel.app/fix/x-content-type-options): The nosniff header stops browsers from guessing file types, preventing some upload-based attacks. It's a one-line fix.
- [Set a Referrer-Policy so URLs don't leak to other sites](https://unspill-scan.vercel.app/fix/referrer-policy): Without a Referrer-Policy, full URLs (which can contain tokens or IDs) may be sent to third-party sites. Set strict-origin-when-cross-origin.
- [Set a Permissions-Policy to switch off camera, mic and location](https://unspill-scan.vercel.app/fix/permissions-policy): A Permissions-Policy header disables browser features (camera, microphone, geolocation) your app doesn't use, limiting what injected scripts can do.
- [Fix mixed content (http:// resources on an https:// page)](https://unspill-scan.vercel.app/fix/mixed-content): Loading scripts, styles or images over http:// on an HTTPS page breaks the padlock and lets attackers tamper with them. Switch every URL to https://.
- [Open CORS on your API: when Access-Control-Allow-Origin * is dangerous](https://unspill-scan.vercel.app/fix/open-cors): If your API reflects any Origin or allows * with credentials, any website can read your users' data through their browser. Restrict CORS to your own domains.
- [Your app isn't using HTTPS: how to fix it](https://unspill-scan.vercel.app/fix/no-https): Serving an app over plain HTTP exposes logins, cookies and data to anyone on the network. Enable HTTPS and redirect all HTTP traffic.
- [Secure and HttpOnly cookie flags: what they do and when to set them](https://unspill-scan.vercel.app/fix/insecure-cookies): Session cookies without Secure and HttpOnly can be stolen by scripts or sent over HTTP. Set Secure, HttpOnly and SameSite on auth cookies.
- [Firebase Security Rules check for AI-built apps](https://unspill-scan.vercel.app/fix/firebase-rules): Your Firebase web config is public by design, so Firestore, Realtime Database and Storage rules are the only protection for user data. Here's how to check them.
- [Google API key (AIza) in your front end: restrict it](https://unspill-scan.vercel.app/fix/google-api-key): AIza keys in front-end code are fine for Firebase but dangerous for Gemini or paid Maps APIs. Restrict them by HTTP referrer and API in Google Cloud Console.

## What it detects
- Secret keys in client code: Stripe (sk_live_, sk_test_, rk_, whsec_), OpenAI (sk-proj-), Anthropic (sk-ant-), Groq, OpenRouter, xAI, Replicate, AWS (AKIA/ASIA), GitHub, Slack, SendGrid, Resend, Twilio, PEM private keys, Google service-account JSON, generic high-entropy secrets
- Supabase service_role JWTs (decodes the role claim) and sb_secret_ keys
- Supabase project URL + anon/publishable key (reported as "verify Row Level Security", with SQL self-checks), Firebase config ("verify Security Rules")
- Publicly downloadable /.env and /.git/config
- Public source maps
- Missing security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; cookie flags
- Mixed content, no HTTPS, permissive CORS

## FAQ
### Is the scan free?
Yes. The instant scan is free with no account and no email required, and you see the full report.

### Is it safe to run on my production app?
Yes. Unspill is strictly passive: it downloads the same public files a visitor's browser does (your HTML, JavaScript bundles and, if public, source maps), checks two well-known sensitive paths (/.env and /.git/config), and sends one CORS preflight (OPTIONS) request to one API path. It never logs in, never submits forms, and never queries your database. A scan makes at most about 20 requests.

### Do you store my results or any keys you find?
No. Scan results are generated on the fly and returned to your browser only. Secrets are masked before they leave the scanner (first few characters and last 4 only), and we never store them. Our hosting logs record that a scan happened (time, hostname) for abuse prevention.

### Why doesn't Unspill test my Supabase tables?
Testing whether tables are readable means querying someone's database. Unspill doesn't do that; it tells you when a Supabase project is present and gives you SQL to verify Row Level Security yourself in a couple of minutes, which is also more reliable than an outside guess.

### My Supabase anon key / Firebase apiKey was found. Is that a leak?
No. Those are designed to be public. Unspill flags them as a reminder to verify Row Level Security or Security Rules, which are what actually protect your data. A Supabase service_role or sb_secret_ key, however, is a critical leak.

### Which apps can I scan?
Only apps you own or have permission to test. Any public http(s) URL on standard ports works, including *.lovable.app, *.bolt.new hosting, *.vercel.app, *.netlify.app and custom domains.

### Does a good grade mean my app is secure?
No. A passive scan can't see your database rules, server code, auth logic or whether one user can read another user's data. It catches the common, easy-to-exploit mistakes. For the rest, join the deep audit waitlist.

## Public incidents referenced
- CVE-2025-48757: missing Row Level Security in Lovable-generated Supabase apps (researcher reported 170 affected projects): https://mattpalmer.io/posts/2025/05/CVE-2025-48757/
- “170 Lovable apps got hacked because of one Supabase setting”: https://www.reddit.com/r/vibecoding/comments/1q2sw99/
- An 18,000-user data leak discussed on r/vibecoding: https://www.reddit.com/r/vibecoding/comments/1rl2mk0/

## Status
Free scan is live. Done-for-you fixes, deep audits and monitoring are on a waitlist (not yet sold). Unspill publishes no customer counts or testimonials.