You built something real.Do you know it's secure?
Built to live alongside Lovable, Bolt, Replit, v0 and Cursor: we scan your repo and your live site, explain every finding in plain English, and hand you a prompt to paste straight back in.
demo/your-app
Security
161
open issues
Accessibility
26
open issues
SEO
40
open issues
Reliability & Performance
16
open issues
Cost
9
open issues
Housekeeping
583
open issues
An example first scan, ranked by severity, so the thirteen things that could hurt you never get buried under five hundred that won't.
It isn't just you
Symbiotic Security scanned 1,072 sites built with AI coding tools. The same handful of gaps came up again and again. Not exotic attacks, just the checks nobody thought to run before launch.
98%
had at least one security flaw. Just 26 of the 1,072 sites came back clean.
172
sites let anyone delete database records with no authentication. One call with the public key could empty a table.
172
sites exposed endpoints that let anyone modify user profiles, settings and content without proving who they were.
39
sites had tables anyone could read using the public key sitting in the page's JavaScript, user data, payments, private messages.
Source: Symbiotic Security, study of 1,072 AI-built sites. These are industry findings about AI-built apps generally.
What we look for
Security
The failures we find most often in AI-built products. None of them are clever attacks. All of them are one line of missing code between a stranger and your users' data.
Keys sitting in your JavaScript
API keys and tokens hardcoded into the bundle every visitor downloads.
Database tables anyone can read
Missing Supabase row-level security or Firebase rules, leaving user records open to anyone holding the public key.
Routes that never ask who you are
API endpoints that create, change or delete records without checking identity.
Secrets committed to the repo
.env files and credentials sitting in your git history, still live long after they were pasted in.
Dependencies with known exploits
Packages carrying published vulnerabilities, including the ones you never chose directly.
Unsafe rendering and missing headers
Patterns that let someone else's content run inside your users' browsers.
Accessibility
The people who can't use what you built, and the standards your customers' procurement teams will ask about.
SEO
The reasons search engines can't find, read or rank the product you just launched.
Reliability & Performance
Slow pages and silent errors that lose people before they ever sign up.
Cost
The cloud bill that quietly triples the first time you get real traffic.
Housekeeping
Dead code, unused dependencies and duplication: the drag that makes every future change slower.
Why can't my AI tool just do this?
Ask the tool that wrote your code whether your code is safe, and it will tell you it is. It is marking its own homework.
It only sees what you paste in
Never your live site, your git history, or the couple of hundred packages you never picked directly.
It answers differently every time
Ask again tomorrow and you get a different list, with no way of telling what it skipped either time.
We run the same checks, in the same order, on every scan, across the whole repository and the running site. AI comes in only where fixed rules can't reach.
How it works
Connect
Sign up, install our GitHub app with read-only access and pick the repositories you want looked at. If your product is already live, add the URL and we look at the running site too.
Scan
Your first scan runs the same day, across all six areas, and lands in your dashboard ranked by severity.
Understand
Every finding in plain English, with the technical detail underneath and a prompt you can paste straight into Cursor or Claude Code.
Keep watching
Subscribers get repeat scans and a notification the moment something critical appears. Your free scan is a one-off snapshot, as set out below.
And then it tells you how to fix it
A list of problems you can't action is just anxiety. Every finding comes with a prompt written for the tools you already build with. Here's a real one.
Security
Your profiles table can be read by anyone
Row-level security isn't switched on for this table. Anyone who opens your site can copy the public Supabase key out of your JavaScript and read every row in it: names, email addresses, and anything else you store there.
supabase/migrations/0002_profiles.sql:14
No alter table ... enable row level security statement on this table.
Fix prompt
In supabase/migrations/, add a migration that enables Row Level Security on the `profiles` table, with policies so a signed-in user can select and update only their own row (auth.uid() = user_id). Do not add a policy granting the anon role read access to all rows. Then check every other table in the schema for the same gap and list any you find. Review the change before merging.
Questions you should be asking
Book your free scan whilst it lasts
Twenty minutes to get you connected. Your first scan runs the same day, and we'll walk you through what comes back.
Ready to talk?
A free 30-minute call. No pitch, just a straight conversation about what you're building or fixing.
©2026 SurgoTech Solutions | All rights reserved | Newcastle upon Tyne, UK | Privacy Policy