Lovable
A lovable fingerprint in the stack, or a hostname ending .lovable.app / .gptengineer.app
Reports A finding you can't act on
A finding you can't act on
is just anxiety
Raw scanner output is a list of things that are wrong, written for someone who already knows what they mean. Every SecScan report goes through a second pass that rewrites it for the person who has to fix it — and generates a prompt aimed at the tool they built with.
What's in a report
Every finding carries its own evidence — the exact HTTP response, header value or decoded payload that triggered it — plus a CWE identifier, a WSTG reference, and a confidence score. On top of that sit five written sections.
- 01
Overall risk
One paragraph a non-specialist can take to a stakeholder.
- 02
Top priorities
What to fix first, ordered by consequence rather than by severity label.
- 03
Quick wins
Findings that clear in minutes — usually a header, a flag or a deleted file.
- 04
Compliance notes
Where findings touch a recognised framework. Omitted when nothing does.
- 05
Agent fix prompt
A paste-ready instruction written for the tool you actually build with.
Fix prompts written for your build tool
"Enable Row Level Security on that table" is correct and useless if you have never opened a SQL console. SecScan detects which tool the application was built with — from technology fingerprints and from the hostname — then writes the remediation as an instruction you can paste straight back into it.
Bolt.new
A bolt.new fingerprint, or a hostname ending .bolt.new / .stackblitz.io
Next.js
A Next.js fingerprint — the Cursor, Claude Code and Vercel workflow
WordPress
A WordPress fingerprint — remediation via plugins and admin, not code
Supabase
Supabase with no major framework alongside it — raw backend instructions
Generic
Nothing specific matched — plain, framework-neutral remediation
Detection runs most-specific-first: a hostname on .lovable.app
wins over a generic React fingerprint, and Supabase only routes to the raw
backend instructions when no major framework is detected alongside it.
Bring your own API key
The analysis runs on DeepSeek. If you would rather spend your own credits than the shared pool — or want your findings going to an account you control — you can save a personal DeepSeek key in Settings. Keys are AES-256 encrypted at rest and never displayed again after saving.
If no key is configured anywhere, the scan still completes and the report still renders. Every external dependency degrades gracefully: the AI pass, the email sender and the payment layer each check for their key at startup and log a warning if absent rather than failing the run.
Sharing a report
Reports are private to your account. To show one to someone — a client, a contractor, the person who actually owns the server — you generate a tokenised share link with an expiry of 7 days, 30 days, or never. Links can be revoked at any time, and revocation is immediate rather than a flag the viewer's cache might ignore.
A share link exposes the findings, which is to say a map of your application's weak points. Prefer a 7-day expiry over "never" unless the report is genuinely meant to be permanent, and revoke it when the conversation ends.
Comparing scans
Rescanning the same target produces a comparison rather than an isolated snapshot: what was fixed, what is new, and whether the grade moved. With continuous monitoring on, that comparison runs on a schedule and a regression — a finding you had cleared coming back — raises an alert on its own.
Confidence scores
Findings carry a confidence value because not all evidence is equally strong. An out-of-band SSRF callback carrying a token that appears nowhere else is confidence 95 — there is effectively no other explanation. A behaviourally confirmed injection sits at 90. A missing header is simply observed. Where a check cannot reach certainty, the report says so instead of rounding up.
Read one against your own site
Free during early access. No account needed to run your first scan.
Generate a report →