Free scan · about 1 minute
Is your AI-built app leaking keys or data?
Paste your URL. In about a minute you get a graded report: API keys hiding in your JavaScript, Supabase tables anyone can read, public .env and .git files, and missing security headers. Every problem comes with a plain-English fix and a copy-paste prompt for your AI builder.
🔒 Free, no signup. You prove you own the site first (2 minutes), because we never scan sites for strangers. The scan only reads public pages, like a browser would. It never logs in, submits forms or changes anything.
Step 2 of 3 · prove it's yours
Verify
Pick one option. Then press Verify and scan. Your code only works for this scan.
Option A: add a small file easiest
Make this URL show the text below:
Using Lovable, Bolt, v0 or Cursor? Paste this prompt and redeploy:
Static sites: put it in public/.well-known/noclipcheck.txt. You can delete it after the scan.
Option B: add a DNS TXT record
In your domain's DNS settings (Cloudflare, Namecheap, GoDaddy…), add a TXT record:
Name / host
Value
Some DNS panels add your domain automatically: then the name is just _noclipcheck. Changes can take a few minutes.
Bookmark this page to come back later: resume link.
Step 3 of 3 · scanning
Usually under a minute. Keep this tab open.
What the free scan checks
The leaks that get AI-built apps hacked
- Secret keys in your JavaScript. OpenAI, Anthropic, Stripe live keys, AWS, GitHub, Supabase service_role and more. We show only the first and last 4 characters.
- Open Supabase tables. If your app uses Supabase, we try one read per table with your public key, the same thing any visitor could do, and tell you yes or no. We never save your data.
- Exposed files. Public
.envfiles,.gitfolders and source maps that hand out your source code. - Security headers and HTTPS. HSTS, Content-Security-Policy, clickjacking protection, cookie flags and HTTP to HTTPS redirects.
What a free scan can't catch
A robot reading your public files can't tell if a logged-in user can edit someone else's data, make themselves admin, skip your paywall or trick your AI agent with prompt injection. Those logic bugs cause the worst breaches, and they take a human. That's the NoClip Launch Check.
How we keep it safe
Owner-verified sites only. Read-only GET requests (about 20 to 60 in total), no logins, no form posts, no guessing passwords or URLs, no load testing. Redirects are only followed on the domain you verified.