24/7 Monitoring.So you can ship with confidence.

Your app scanned from the outside, the way an attacker sees it.

Developed for builders using AI.

01234567890123

secrets pushed to public GitHub so far this year

projected · 2025 total +34% YoY

Scans apps built with:

~1 in 9

indie apps leak a database key

< 60s

from URL to ranked report

to scan a public URL

checks audited

//This isn’t hypothetical.

You don’t have to take our word for it.

Independent security research keeps finding the same thing at scale.

29M

hardcoded secrets found on public GitHub in 2025 alone (+34% jump)

64%

of secrets leaked in 2022 are still valid today: never rotated, still exploitable

2×

the rate at which AI-assisted commits leak secrets compared to human baselines

Source: GitGuardian, State of Secrets Sprawl 2026

//Coverage

The mistakes AI writes on autopilot.

Every one of these is a pattern code generators produce, in code that reads as completely fine. Flare checks for all of them from the outside, the way a stranger would, and reports what it can actually reach.

CRIT

Leaked keys, proven still working

Finds secret keys accidentally shipped in your app's code, then proves it by testing each one against the provider that issued it. Free shows live status on your worst finding; Pro shows it for every key.

CWE-798

CRIT

Databases anyone can read

Spots Supabase and Firebase, then checks whether your data and uploaded files can be read by anyone, no login needed. The single most common vibecoding mistake.

CWE-284

CRIT

Secrets leaking into your pages

Sometimes a secret meant only for your server ends up written into the web page itself, anyone can find it by viewing the page's source. We find it and show you the exact one.

CWE-200

CRIT

Forgotten admin & debug pages

Leftover admin and debug pages from when you were building. Nothing in your app links to them, so you forget they're there, but attackers go looking. So do we.

CWE-489

CRIT

Secret keys sent to every visitor

To silence an error, an AI assistant sometimes renames a private key so it's allowed in the browser, quietly shipping it to everyone who visits. We catch keys that shouldn't be public.

CWE-522

HIGH

AI features that run up your bill

Finds AI features anyone can trigger without logging in, the ones an attacker can hit over and over to run up a huge OpenAI or Anthropic bill in your name.

CWE-770

HIGH

Pages that should be locked but aren't

Finds the behind-the-scenes web addresses your app uses, and checks which ones answer anyone, no login required.

CWE-306

CRIT

Login tokens exposed in links

When a login token is put into a web link, it gets saved in browser history and server logs where other people, and other sites, can pick it up.

CWE-598

CRIT

Private files left downloadable

Checks whether your settings file, your source code folder, or a database backup can be downloaded straight off your live site by anyone.

CWE-538

MED

Missing basic protections

Standard safety settings every site should send to browsers (things like CSP and HSTS), quick wins that AI-generated apps almost always skip.

CWE-693

You don’t have to remember any of these. That’s the point.

See all 36 checks Why they survive code review

//Why Flare, not a linter

A linter hands you two hundred warnings.

Flare hands you the ones that are real, in the order they’d hurt. Free shows your worst finding in full with proof and the fix; Pro opens evidence and the exact line to change for every finding.

Live-key verification

No wall of maybes.

Every key we find is tested against the provider that issued it. A key you already rotated comes back as rotated and graded down, not as a five-alarm fire. Being slowed down by false alerts is the actual problem with most security tools.

How a key is graded live, revoked or unverified

Toxic combinations

Two small bugs are one breach.

An open table is a bug. An unguarded admin route is a bug. Together, they’re a way in. Flare detects those toxic combinations on every scan: free shows the count, Pro opens the full path.

How combinations are ranked

//Live feed

What it finds, as it finds it.

Scans feed an anonymized stream: the category of what was found, and nothing else. No app names, no URLs, no evidence. We disclose to the developer first, always.

flare / example output

-app-••••-3f2Secret leakCRIT

-app-••••-91aDatabase exposureCRIT

-app-••••-7c0Server-to-client leakCRIT

-app-••••-e48Shadow API routeHIGH

-app-••••-a12Cost-drain exposureHIGH

-app-••••-2dbHeadersMED

//CI / CD

Ship it into your pipeline. Nothing broken ships.

One line in your pipeline. Flare runs on every pull request and fails the build the moment a critical exposure appears, so the leak is caught in review instead of production.

Runs on every push & PR: no schedule to babysit
Fails the build on critical: the merge is blocked, not just flagged
Also available as a CLI & API: scan from your terminal or scripts

# add to your CI, runs on every push
steps:
  - uses: actions/checkout@v4
  - run: npx flare-deep . --fail-on critical
    # exits non-zero on a critical finding → build fails

//The vibecoder feature

Give the AI that wrote it the tool that checks it.

Flare ships an MCP server, so Cursor, Claude Code, and Windsurf can scan your app themselves. It works against localhost. The agent starts your dev server, scans it, fixes what it finds, and rescans. The leak never reaches a commit.

flare_scan_url : scan a running app (localhost included)
flare_scan_repo : scan the source, with file:line to fix directly
flare_verify_credential : is this key still live, or already rotated?

Works with

See how it works

cursor · mcp · flare

agent → flare_scan_url("http://localhost:3000")

VERDICT: BLOCKING, 1 critical

[CRITICAL] OpenAI API key exposed

✓ confirmed live

fix: rotate at provider, move to a

server-only env var

agent → applies the fix, rescans

VERDICT: CLEAN

no findings at or above "critical"

# the human never saw the leak

//What a real report looks like

Evidence first. Then the fix.

These are the kinds of findings Flare returns, each one with a probe you can re-run yourself. Not composite quotes from people who do not exist yet.

service_role key · confirmed live

Key found in a client bundle, then probed against Supabase. Status comes back live, revoked, or unverified, not guessed from the shape of the string.

open table + unauth route

Two findings alone look medium. Together they are a path: readable data through a route that never asked who you are. That path is a toxic combination.

revoked key · graded down

A key you already rotated should not scream critical. Verification drops severity when the provider says the credential is dead.

RSC prop leak

Secrets passed from a Server Component never appear in a .js file. Flare reassembles the React flight payload in the HTML and finds them anyway.

shadow /api/debug route

Routes the UI never links to still answer when probed. A random control path runs first so apps that 200 everything stay quiet.

NEXT_PUBLIC_ holding a server secret

Renaming a secret to silence a build error ships it to every visitor. Flare flags public-prefix vars that look like credentials.

Find out what’s leaking. Takes thirty seconds.

One free scan per site. No account, no config, no sales call.

Run your free scan