Is your AI-built app leaking data?
Paste your address. Rustine looks at your site the way a stranger would, shows you what they can read, and hands you the fix to paste into your agent.
Free, no card, under a minute.
Find the leaks. Stick the patch on.
31/100 · F
Looking at what a stranger sees…
3 leaks found Anyone can read this on your site.
- criticalAnyone can read the 1,204 rows of your users table.
- criticalYour Stripe payment key is visible on your site.
- highYour passwords file is online.
The scan looks at your site the way a stranger would.
The scan looks at your site the way a stranger would.
Your users can be read without a password.
Your payment key sits in plain sight on your page.
Your passwords file opens like any web page.
You copy the fix into your AI. It repairs.
For apps built with
Comparing? Rustine and VICE · Rustine vs UNPWNED · Rustine vs VibeEval · Rustine vs CheckVibe · Rustine vs Vibe App Scanner · Rustine vs Aikido · Lovable and Rustine
What we find
What coding agents forget most often.
Anyone can read your database
A stranger can download your customer list, no account, no password.
Your payment key is visible to everyone
With it, someone can refund your sales or take payments in your name.
Your server passwords are online
The file that holds them opens like a web page. Whoever reads it gets in.
Your app shows every user's details
Emails, phone numbers, addresses: your app sends them to every visitor, even when the screen hides them.
A tool you use has a known flaw
The version your app runs has a hole that's already public. Bots look for it every day.
Cookies set without consent
Your site drops trackers before the visitor says yes. Regulators fine sites for that.
A report
One sentence, one proof, one fix.
On a sample site. Click an issue.
52 /100 · D
mysaas.com · full audit
4 issues, 14 checks passed
Your users table has no RLS policy. The anon key, visible in your JavaScript, is enough to read its 1,204 rows. Rustine counted them without opening a single one.
HEAD /rest/v1/users (anon key) → 200 · 1,204 rows readable
In Supabase, turn on RLS for public.users. Add a policy so a signed-in user only reads their own row (auth.uid() = id). Write the migration in supabase/migrations, without touching the other tables. When done, call the Rustine tool recheck_issue.
Your server hands the .env file to anyone who asks. It holds your Stripe secret key.
GET mysaas.com/.env → 200 · STRIPE_SECRET_KEY=sk_live_••••
The .env file is served publicly. Move it out of the public folder, block files starting with a dot, then roll the Stripe secret key in the Stripe dashboard.
Without a CSP, a script injected into your page runs with no limit.
GET / → no Content-Security-Policy header
Add a Content-Security-Policy header in next.config.js, listing only the domains your app needs (Supabase, Stripe).
The _ga cookie is set on arrival, before the visitor said yes.
Set-Cookie: _ga=GA1.1.•••• on the first response
Load Google Analytics only after consent, or switch to a cookieless tool.
In your AI
Plug Rustine into your AI, and let it fix things.
Claude, ChatGPT, Cursor… Your AI picks up what Rustine found and repairs it. Rustine then checks it's really sealed.
- 01Connect Rustine to your AI, in one click from the app.
- 02Tell it: “fix what Rustine found”.
- 03Rustine checks again and tells you when it's fixed.
Included in Pro. 14-day trial with Solo.Plug in Claude, ChatGPT or Cursor
After the first scan
Rustine keeps watching after the first scan.
Told as soon as a new flaw hits your app
A flaw is published on a tool your site uses? You get an email with the version that fixes it, no new scan needed.
Learn moreYour site audited again every week
Every week, Rustine runs the full audit of your verified site again. You get an email only when something changed: a new issue, an issue fixed, your score.
Learn moreRustine reads your code too
Connect GitHub: every update to your code gets read. Forgotten secret keys, a database left open, pages with no login, risky code. Next.js, Supabase, WordPress, Laravel, Python, iOS and Android apps…
Learn moreSecurity good habits for your stack
Checks written for Supabase, Firebase, Stripe, Next.js, WordPress… so your AI doesn't repeat the classic mistakes. Every issue comes with its fix to paste.
Learn moreHow we test
Hand-written checks, not AI guesses.
Each check is a precise rule, tested on apps with holes on purpose. An issue only shows up when a request you can replay proves it. AI only writes the fix.
- 35 site checks
- 89 code rules
- known flaws updated every hour
Free tools
No account, in a few seconds.
Pricing
The scan is free. The full audit and the fixes are paid.
Launch price until Friday 16 October, 8 pm Paris time, kept as long as your subscription runs.
€0forever
To see what a visitor sees.
- 1 project
- 1 address per project
- 10 quick scans a month
- The details, once your site is proved
- 3 free fixes, as a prompt for your agent
- The “Verified by Rustine” badge
- 30 days of history
€14a month€19
To test everything and fix everything. Your price holds as long as you stay.
- 1 project, +€5 per extra project
- 5 addresses per project
- 30 full audits a month
- Your verified sites audited again every week
- An email when a flaw hits a version you use
- 15 fixes a month
- Rustine writes the code of your fixes (AI Fix)
- Your GitHub repos analysed on every push
- MCP server: 14-day trial
- The “Verified by Rustine” badge
- The PDF report, to send to a client
- 1 year of history
€34a month€49
For several apps, and your AI fixing on its own.
- 10 projects, +€5 per extra project
- 20 addresses per project
- 30 full audits a month per project
- Your verified sites audited again every week
- An email when a flaw hits a version you use
- 30 fixes a month per project
- Rustine writes the code of your fixes (AI Fix)
- Your GitHub repos analysed on every push
- MCP server for your agent
- The “Verified by Rustine” badge
- The PDF report, to send to a client
- 2 years of history
Questions
Is it legal to scan my site?
Yes, it's yours. Without proof, Rustine only does what a visitor would. Deeper tests wait until you prove the domain is yours.
What about a site that isn't mine?
You see how many issues there are by severity, never what they are. The details are for the owner.
Does Rustine change my code?
Never. You paste the fix into your agent, or your agent fetches it through the MCP server. Rustine reads, your agent writes.
I build with Lovable or Bolt, no GitHub. Does it work?
Yes, scanning the site is enough. The repo adds what only shows in the code: secrets in the history, vulnerable dependencies.
Does it scan on its own?
With Solo and Pro, yes: every week, Rustine runs the full audit of your verified sites again, from your monthly quota, and only writes to you when something changed. You can turn it off project by project. And an email goes out when a newly published flaw hits a version your app uses. On Free, you start every scan.
Where does my data go?
Hosted in Europe. Secrets we find are masked before they're stored, and your code isn't kept.
I don't want my site scanned.
A site's owner can exclude it from Rustine, on the “Exclude my site” page.