For people who build apps with AI
Find and fix the security holes in your vibe-coded app before customers' data is at risk.
An AI tool can ship an app in a weekend. It can also ship a key in the code, a demo login that still works, or a database table anyone can read. Sting Shield scans your code every night and whenever you ask, and tells you in plain words what it found, why it matters and exactly how to fix it.
Be clear about what this is. A program does the checks: they read your code and look for known patterns. No person reviews your findings at this price. Sting Shield reads your code and never runs it. Your findings are private: only you see them, and only counts ever leave.
Fast to build is not the same as ready for customers.
A few lines of generated code can hold the gaps a buyer's security review looks for first. Most of them are easy to close once someone shows you where they are.
Keys in the wrong place
A password or API key pasted into a file, or committed once and deleted. Deleted is not gone: it is still in the git history.
Doors left open for testing
A seed route, a demo login or a test back door that was handy in development and still answers in production.
One user reading another's data
A route that looks up a record by an id and never asks whose record it is, or a database table with no row-level security.
What Sting Shield checks today
Every item here is a check that exists in the scanner now. A check that cannot run says "Not checked". It never says "clean".
Keys, tokens and passwords
Secret scanning of your files and of your full git history, so a key that was committed once and removed still shows up. A person has to rotate every key it finds.
Dependency vulnerabilities and licenses
Known vulnerabilities in your npm and Python packages, using the standard audit tools when they can reach their advisory lists. It also reads each package's license and flags ones that ask for more than credit, such as GPL.
Security headers
Whether your server or host config sends a Content-Security-Policy and the other common security headers. It reads code and config, and does not load your pages.
Login limits, demo logins, test back doors
Whether sign-in routes limit failed tries. Logins published in docs. Seed, debug, reset and test routes that nothing switches off in production.
Weak password storage
Passwords hashed with MD5 or SHA, bcrypt set too low, or passwords stored as typed.
Cross-user record access
Heuristics for routes that read a record by an id from the address with no owner, team, tenant or role check, and for database tables a signed-in client can reach with row-level security never turned on.
Injection, SSRF and path traversal
Heuristics for a database filter built from the raw request, a server fetch of an address taken from the request, and a file read or written at a path built from the request.
File uploads and private data in logs
Upload handlers with no size limit or no type check. Log lines that carry a password, token, sign-in code, email, phone number or the whole request.
Flags, not verdicts
Where the code touches areas like marketing email, calls and texts, trackers or health and recovery data, it flags what it found. It never says a company is "compliant". Counsel decides what the law requires.
A look at your own sites
The probe visits only the sites you confirm are yours, the way a stranger would. It uses GET and HEAD only, is rate-limited, never logs in and never submits anything. It looks for exposed files, source maps, keys in public scripts and missing headers.
How it works
You do it yourself, in a few minutes. Sign-up is not open yet: sign-in email and billing are still being set up.
Sign in with your email
We email you a six-digit code. There is no password to leak.
Connect your code
Paste a public GitHub address or upload a zip. Private repos: coming soon.
It scans
Every night for GitHub apps, and whenever you press Scan now. It reads the files and never installs, builds or runs them. Your code is deleted after each scan.
You fix
Each finding says what it is, why it matters and exactly how to fix it. Only you can see it.
One price: $9.99 a month
Per account. Cancel any time from the billing page. Payments are handled by Stripe.
Sting Shield
$9.99
a month, per account
- Up to 3 apps
- Scans your code every night and whenever you ask (Scan now up to 5 times a day)
- Public GitHub repos and zip uploads. Private repos: coming soon.
- Plain-English findings: what it is, why it matters, exactly how to fix it
- A look from the outside at up to 3 sites you prove are yours
- Download everything, or delete everything, at any time
What $9.99 does not include
- No person's review. A program does the checks and nobody reads your findings for you. A person's review is coming later as an extra. It has no price yet.
- No guarantee. The checks can miss real problems and can flag things that are fine.
- Not legal advice, and not a SOC 2 report or any other certification.
- Zip apps are not scanned at night. Upload again to scan again.
What Sting Shield does not do
- It does not prove your app is safe. The checks are heuristic. They read code for known patterns and can miss things or flag things that are fine. No person reviews your findings at $9.99 a month.
- It does not watch your app all the time. It scans every night and whenever you ask. Between scans it is not looking.
- It only scans what you own. Connect only code you own or are allowed to test. It looks at a site from the outside only after a DNS record proves the site is yours.
- It holds no SOC 2 report or other certification, and a scan does not give you one.
- It does not give legal advice. Legal-risk flags say what was found, not what the law requires.
- It does not promise an outcome. It finds gaps. People close them.
- It does not claim a clean result it did not earn. If a check could not run, the report says "Not checked".
The first company on Sting Shield is Cross Universal.
Cross Universal's security record in Sting Shield is imported from its own code, control by control. A control counts as passing only when the file it names exists and its test is in Cross Universal's own test chain. The record also says what Cross Universal does not have yet. It has no auditor and no SOC 2 report, and the record says so.
You can look at the sample company, labeled Sample, in the app.
Want a person to look?
A person's review is not part of the $9.99 plan. It is coming later as an extra, with no price yet. To hear when it is ready, or to ask a question, leave your details. This form saves your request for a person to answer. It does not send an email, and it does not start a scan.