AI-native deployment & agent security
Make the invisible visible.
Scan your AI-built app — Lovable, Bolt, v0, Replit Agent, Cursor — for exposed keys, open databases and missing security headers. Clear findings in under a minute.
Free first scan · No signup · Results in under a minute
Of probeer een sandbox-target — veilig & vooraf goedgekeurd
Vibe Coffee · vuln demo
CerynAI's eigen kwetsbare demo-app. Triggert álle 10 scans: blootgestelde secrets, open .env / .git, kwetsbare dependencies, een chatbot-surface en een open MCP-endpoint.
Alle checks · grade F
Google Firing Range
Google's open test-applicatie voor scanners. Bewust onveilig en publiek beschikbaar gesteld om tegen te testen.
Headers · disclosure
testhtml5.vulnweb.com
Acunetix' publieke kwetsbare testsite — dezelfde klasse deployment-fouten die vibe-coded apps ook maken.
Ontbrekende headers · cookies
What CerynAI looks for
Deployment hygiene, supply-chain risk, and the new Layer-2 agent surface.
Exposed secrets
Live API keys hardcoded into your frontend bundle. Stripe, OpenAI, AWS, Anthropic, GitHub — anything an attacker can lift from `view source`.
Open Supabase / Firebase
The Lovable/Bolt classic: a public anon key plus tables without Row-Level Security. Anyone reads your users table.
Public .env / .git
Config files and source-history downloads served straight from your webroot. We probe the usual suspects.
Missing security headers
No CSP, no HSTS, no X-Content-Type-Options. The defaults that turn a small XSS bug into account takeover.
Insecure cookies
Session cookies without HttpOnly, Secure or SameSite — the kind of mistake that turns one XSS into total account takeover.
Version disclosure
Server, X-Powered-By, generator meta tags. Each one tells an attacker which CVE list to walk down first.
Dependency & supply-chain
Known CVEs in your packages, plus typosquats and hallucinated 'slopsquat' dependencies that AI assistants invent and attackers register.
AI agent surface
Chatbots and assistants add a Layer-2 surface: prompt injection, system-prompt leaks and unintended tool use. We flag it where classic scanners don't look.
MCP server posture
An unauthenticated MCP server hands any client your tools and data. We probe the origin for exposed endpoints and an open tools/list.
API & schema exposure
GraphQL introspection and public OpenAPI/Swagger docs hand an attacker a complete map of your API — every endpoint, parameter and model.
Verbose errors
Stack traces and framework error pages that leak file paths, versions and internal logic the moment something breaks.
JWT weaknesses
Tokens signed with alg:none, tokens that never expire, or role claims sitting readable in the browser.
Exposed system prompt
The AI's instructions and guardrails hardcoded in the frontend bundle — the blueprint for bypassing them, and often a password or hidden endpoint too (LLM07).
How it works
Paste your URL
Your deployed app — Lovable, Vercel, Netlify, Replit, anywhere with a public address.
We probe like an attacker would
Non-intrusive, external scan. We only do what any visitor's browser would do, plus a few well-known config-file probes.
Get a CVSS-style report
Every finding has a severity, exact location, why it matters and a concrete fix. Show it to your developer or your customer.
Built for the people AppSec forgot
Vibe-coders & solo founders
You shipped with Lovable or Bolt. You don't have a security team. You don't even have a developer. You just need to know: is this safe to put my customers on?
MSPs, accountants & insurers
You serve mkb clients facing NIS2 and DORA. White-label CerynAI under your own brand — your logo, your colours, your name on the report.