SniffPup

SniffPup is a passive, read-only security scanner for apps made with AI builders like Lovable, Bolt, and Cursor. It loads your live app the way a visitor’s browser would and performs 15 outward-facing checks to spot common problems that get shipped when secrets or configurations end up publicly accessible.

Paste a public http(s) URL, then review a plain-English report sorted by severity. SniffPup focuses on issues such as leaked API keys found in page content and JavaScript, exposed public environment variables, and Supabase key leaks (including service-role keys accidentally shipped to the browser). It also looks for exposed files like .env, .git, .npmrc, backups, SQL dumps, and other sensitive artifacts.

Beyond key and file exposure, SniffPup checks for publicly accessible source maps, missing or weak security headers (like HSTS and CSP), cookie flag issues, HTTPS redirect behavior, and HTTPS certificate problems. It tests CORS to see what other websites can read, checks email spoofing protections via DNS records (SPF/DMARC/DKIM), and flags AI crawler access signals using robots.txt and llms.txt.

SniffPup is free to scan (no signup). For full fix reports, there’s a one-time $9 option for an individual app, and monthly plans starting from $7/month for ongoing re-scans and alerts. SniffPup never logs in for the scan, never sends attack traffic, and masks any secrets it finds.

What does SniffPup scan when I paste my app URL?

It performs 15 passive, visitor-level checks on your public http(s) site—loading the page like a browser, scanning for exposed keys and variables, checking for exposed files and source maps, reviewing security headers and HTTPS behavior, and testing CORS, AI crawler access signals, and more.

Is SniffPup a penetration test or does it log in to my app?

No. The scan is passive and read-only: it doesn’t log in, doesn’t send attack traffic, and doesn’t require code access. It only checks what a visitor can see.

Does SniffPup store the secrets it finds?

Secrets it detects are masked in the reporting. The scan is designed to be read-only (it never logs in and never sends attack traffic).

What do I get if I run the free scan?

You get to see every issue SniffPup finds in the report, with fixes included for critical issues. If you have no critical issues, one additional fix is free.

How much does the full fix report cost?

There’s a one-time $9 option for a full fix report for one app, with 30 days of free re-scans. Monthly plans are also available starting from $7/month.

Does a clean SniffPup report mean my app is fully secure?

No. A clean report means the tool didn’t find issues in the checks it runs, but it isn’t a guarantee of overall security.