Sumbrel scans your app continuously, catches security holes and alerts you before they cost you customers and revenue.
Garry Tan1.1M followers
Pieter Levels971K followers
Guillermo Rauch905K followers
Greg Isenberg727K followers
Claude, Cursor, Lovable, Bolt: AI builds your SaaS in a weekend. But it won't think about
the Stripe key left in your frontend, or the .git folder still live in prod.
of AI-generated code introduces an OWASP Top 10 vulnerability.
API keys and secrets exposed, found across 5,600 vibe-coded apps already in production.
Lovable apps analyzed left their database readable by anyone (170 of 1,645).
The good news: most of these holes are visible from the outside. So Sumbrel sees them too.
The founders of Sentry, Supabase, Replit, Vercel and Lovable, the head of Y Combinator, indie hackers and ethical hackers: what they said about app security in 2026.
Rhys Sullivan@RhysSullivan
the first vibe coded app i've actually dug into had no RLS rules and all their customer data exposed
Founder in Y Combinator's 2026 batch.
View on X
Jamieson O'Reilly@theonejvo
They are exposing their entire database to the public with no protection including secret api_key's
About Moltbook, the AI-agent social network everyone was talking about (1.8M views).
View on X
Prajwal Tomar@PrajwalTomar_
Without RLS, anyone can open DevTools and read your entire database. […] API keys in the frontend means game over.
From his pre-launch checklist for AI-built apps (950K views).
View on X
Pieter Levels@levelsio
I guess at some point it got hacked and the Claude key inside OpenClaw got exposed and then they waited for months before using it
An API key left on an old server, used by someone else months later.
View on X
Tony Dinh@tdinh_me
burned ~$70 worth of tokens and resulted in 30+ PRs, all non-critical but totally legit security issues.
After running a security audit tool on his own SaaS codebase.
View on X
Peer Richelsen@peer_rich
"hey claude find vulnerabilities in this repo" is something my angry neighbours son can type into a terminal
On AI-driven attacks changing app security.
View on X
Pop Punk@PopPunkOnChain
If you want free API keys just open the network tab on literally every vibe coded app.
In 24 hours of checks, he saw private credentials leaking 9 times out of 10 (346K views).
View on X
Burak Eregar@burakeregar
today i HACKED 5 different apps from famous indie hackers on X […] 500.000 users' personal data
He warned each founder privately: "we are coding fast with AI agents but it comes with huge risks".
View on X
Greg Isenberg@gregisenberg
AI made it 100x easier to build. it also made it 100x easier to attack.
The day Vercel disclosed its breach.
View on X
David Cramer@zeeg
It's the worst security footgun you can imagine. One small mistake and your data is available to the world.
On database row-level security rules (6.8M views).
View on X
Paul Copplestone@kiwicopple
security cannot be vibe-coded. it need to be tested, retested, and tested again.
Presenting Supabase's security tools.
View on X
Garry Tan@garrytan
you're much more likely to get hacked via infra attack surface than code bugs
Shipping a security guide for founders.
View on X
Guillermo Rauch@rauchg
As the world's paranoia grows given ever-more-sophisticated AI adversaries, how can you trust a 2-person-and-a-dog company?
On what security means for small startups.
View on X
Amjad Masad@amasad
Sometime apps you made that are secure might suddenly become vulnerable […] Typically you need engineers on payroll to monitor and handle this.
When an exploit shows up in one of their dependencies.
View on X
Gergely Orosz@GergelyOrosz
Few things are more embarrassing for any company than to only learn from your customer that you have been breached.
After an AI startup's breach was discovered by its customer, Vercel.
View on X
Anton Osika@antonosika
The team learned about the incident on X because our own vulnerability disclosure process was broken.
After a security incident at Lovable.
View on XExcerpts from public posts; each card links to the original. None of these people is affiliated with Sumbrel or talking about it.
No genius required. Bots probe thousands of sites for these mistakes every single day, on autopilot. Sumbrel runs the same checks, for you.
See what they see, before they doindex-8f2a.js: sk_live_51Hx…
Enough to list your customers, issue refunds or create payments on your behalf.
GET /.git/HEAD → 200 OK
Your entire source code, downloadable by anyone.
jquery 1.8.3 → 5 CVE
Public, documented vulnerabilities, with exploits ready to go.
index-8f2a.js.map → 200 OK
Your original code, readable in plain text, comments included.
_dmarc: p=none
Anyone can send emails pretending to be you.
known vulnerabilities. Every day. Sumbrel matches your libraries against public vulnerabilities (200+ new ones every day) and runs 30+ configuration checks on top.
Every vulnerability comes with the exact prompt to fix it. Sumbrel rescans your URL every 24 hours, and your dashboard shows how your security evolves. Example on a fictional app.
staging.assets/index-8f2a.js: sk_live_51Hx…
What it enables: an sk_live key unlocks your Stripe account. List your customers, issue refunds, create payments.
GET /.env → 200 OK · 1.2 KB
CVE-2020-11022, CVE-2020-11023, CVE-2019-11358…
assets/index-8f2a.js.map → 200 OK
Content-Security-Policy: (missing)
_dmarc.myapp.example: p=none
GET /.well-known/security.txt → 404
assets/index-8f2a.js: sk_live_51Hx…
This key unlocks your Stripe account: list your customers, issue refunds, create payments.
// app/api/checkout/route.ts: the secret key stays on the server
import Stripe from "stripe";
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
export async function POST(req: Request) {
const { priceId } = await req.json();
const session = await stripe.checkout.sessions.create({
mode: "subscription",
line_items: [{ price: priceId, quantity: 1 }],
success_url: `${process.env.APP_URL}/thanks`,
cancel_url: `${process.env.APP_URL}/pricing`,
});
return Response.json({ url: session.url });
}
// Frontend: no secret key anymore, just call the route
const { url } = await fetch("/api/checkout", {
method: "POST",
body: JSON.stringify({ priceId }),
}).then((r) => r.json());
window.location.href = url;
In my project, a secret Stripe key (sk_live_…) is exposed in the frontend bundle: assets/index-8f2a.js. 1. Find every place where the Stripe secret key is used client-side and remove it from the frontend code. 2. Move the Stripe calls that need the secret key into a server route (API route or edge function). That route reads the key from a server-side environment variable. 3. Make sure no secret variable has a browser-exposed prefix (VITE_, NEXT_PUBLIC_, REACT_APP_). 4. On the frontend, only use the publishable key pk_live_. 5. Don't change anything else, and list the files you changed.
Sumbrel only reads what your site shows publicly: headers, certificate, DNS, shipped JavaScript. Exactly what a browser sees.
Tests on .env, .git or config files only run once you prove you control the domain: a tag on your site, a file or a DNS record. The proof is re-checked on every scan.
Not a full pentest, and not an intrusion attempt. Sumbrel catches the misconfigurations and leaks visible from the outside, the ones bots exploit first. No tool can guarantee 100% security.
A one-off audit costs thousands and goes stale with your next deploy. Sumbrel shows you what an attacker would see, every single day, with the fix ready to paste. For the price of a streaming subscription.
Pro
All-in
One plan. Every fix, on-demand scans, monitoring with alerts, the deep scan and analysis of every deploy.
Your libraries checked daily against public vulnerabilities (CVEs). 200+ new ones land every day, and you don't have to keep up.
.env, .git, exposed configs: the most critical holes, checked on your domain.Yes. The passive scan only reads what your site shows publicly, just like a browser. Deeper tests (.env, .git, config files) only run after you've proven you control the domain: a tag on your site, a file or a DNS record.
No. Sumbrel never attempts an intrusion and never sends an attack. It makes read-only requests at a reasonable pace, like a curious visitor.
To open your account and keep your action plan there, with the fix for every priority issue. The surface scan reads what your site shows to everyone: its result isn't secret and contains no exploitable evidence. What really touches your security, the deep scan (.env files, .git repository, backups…), only runs once you've proven the domain is yours: a DNS (TXT) record, re-checked before every scan.
The free scan gives you your score and a preview of your vulnerabilities. With Pro, you see every detail, get a ready-to-paste fix for each one, your URL is rescanned every 24h, and you're alerted the moment a deploy opens a new hole.
Yes. Every vulnerability is explained in plain English, along with what it lets an attacker do. To fix it, paste the prompt into Claude or Cursor, or drop in the code we give you.
Yes, and that's where Sumbrel shines. It recognizes these tools and checks first for the mistakes they leave behind most often: keys in the frontend, exposed files, missing headers.
No. Sumbrel catches the misconfigurations and leaks visible from the outside, the ones bots exploit first. A pentest digs deeper into your app's logic. The two go hand in hand.
Yes. Sumbrel Pro has no lock-in, and you can cancel in one click from your account.
Practical guides to check your SaaS by hand: Supabase and Firebase rules, security headers, secrets in your JavaScript and more. Every number links to its source.