Built with Lovable, Supabase, Base44, or Bolt? Decloak scans your app for the security issues AI builders consistently skip, starting with the #1 vibe-coder failure: a Supabase database left publicly readable because Row Level Security was never turned on. It auto-detects your platform, checks 8 layers including exposed API keys and leaked service_role keys, and returns a graded report in 15 seconds. Free, no account or card required.
- Free security scan results in 15 seconds
- AI agent investigates findings across the whole site
- Authenticated pentesting behind login
- Compliance‑ready evidence mapped to SOC 2, ISO 27001, NIS2, DORA, LGPD, PCI DSS
- Explicit OWASP Top 10 coverage checklist on every report
- Scans across 8 layers: JS libraries, hidden trackers, subdomains, DNS/TLS, databases, etc.
Decloak provides instant AI-driven web security scans and deeper investigations for AI-built apps.
- for
- Vibe coders, solo builders, small businesses, compliance teams, agencies, MSPs
- pricing
- freemium
works withSupabaseLovableBase44BubbleNext.jsWordPressShopifyMagentoGraphQLRESTSOAP
Key features
8 features of Decloak - Web security intelligence
- Single-page instant scan — Scans any URL in under 15 seconds across 8 security layers without an account.
- 8-layer security analysis — Checks HTTP headers, HTML, network traffic, JS CVEs, tag managers, third-party domains, platform misconfigurations and server/CMS CVEs.
- Platform fingerprinting — Automatically detects Lovable, Supabase, Base44, Bubble, Next.js and applies specific checks.
- AI investigation agent — Full-site agent reads findings, fetches scripts, checks domains and produces remediation guidance.
- Compliance evidence — Maps findings to SOC 2, ISO 27001, NIS2, DORA, LGPD, PCI DSS and exports PDF audit packages.
- Active Security Testing (DAST) — Enterprise tier runs safe forced-browsing, CORS, HTTP-method probes and provides an independent score.
- AI Pentesting — Sandboxed sqlmap, dalfox, ffuf, nuclei, jwt_tool runs confirm exploitation against flagged targets.
- Priority Remediation Plan — Ranks top-25 fixes, provides plain-English AI guidance and exportable PDF.
Use cases
- Quick sanity check of a newly launched AI-built web app.
- Monthly compliance evidence generation for SOC 2 or ISO 27001 audits.
- Detecting exposed API keys or misconfigured Supabase databases.
- Agency managing security posture across multiple client domains.
- Running active penetration testing on production sites.
Decloak - Web security intelligence pricing
- Free£01-page scan per submission · All 8 scan layers · AI executive summary · OWASP Top 10 checklist
- Starter£29/monthFull AI agent investigation · Up to 50 pages per scan · Priority Remediation Plan · DNS & TLS analysis
- Pro£79/monthUp to 200 pages per scan · ISO 27001/SOC 2/NIS2/DORA/LGPD/PCI DSS mapping · Team access & assignment · Slack/webhook notifications
- Enterprise£99/monthActive Security Testing (DAST) · AI Pentesting with exploitation confirmation · Authenticated scan mode · Independent pentest score
Decloak - Web security intelligence vs alternatives
 Decloak - Web security intelligence |  aikido |  Perfai Security |  LAN Sheriff | .png?width=64) Langfuse | |
|---|---|---|---|---|---|
| Best for | AI-app security scanning | Broad security linting for developers | Rapid vulnerability spotting | Device-level network visibility | LLM app monitoring |
| Pricing | Freemium | Free | Free | Free | Subscription |
| DevHunt upvotes | 2 | 65 | 30 | 32 | 89 |
| Launched | Oct 2026 | Dec 2024 | Jun 2026 | Aug 2026 | Jan 2023 |
- Decloak - Web security intelligence vs aikido: Focuses on general dev-security hardening, not AI-app platform fingerprinting
- Decloak - Web security intelligence vs Perfai Security: Offers one-prompt vulnerability detection, but lacks multi-layer scanning and compliance mapping
- Decloak - Web security intelligence vs LAN Sheriff: Monitors network traffic of devices rather than web app security layers
- Decloak - Web security intelligence vs Langfuse: Observability for LLM apps, not web security scanning
Decloak - Web security intelligence FAQ
Do I need an account for the free scan?+
No, the free tier works without creating an account or providing a credit card.
What platforms does Decloak automatically detect?+
It fingerprints Lovable, Supabase, Base44, Bubble, Next.js and many other AI app builders.
How does Decloak help with compliance audits?+
Findings are automatically tagged to SOC 2, ISO 27001, NIS2, DORA, LGPD and PCI DSS controls and can be exported as PDF evidence packages.
What is the difference between the free and paid scans?+
The free tier scans a single page; paid plans run a full-site AI agent investigation, scheduled scans and compliance reporting.
Can Decloak perform active penetration testing?+
Yes, the Enterprise plan includes Active Security Testing (DAST) and AI-driven pentesting with sandboxed exploitation tools.
Summarized by DevHunt from decloak.dev · Sep 29, 2026. Details may change; check the official site.
What people say
1 quote from around the web
“Great potential, but it needs more control and polish. They are working hard on the improvements I mentioned below.”
AgnidhraC · appsumo.com
.png?width=64)
