Find what your app accidentally exposed.
Your AI wrote the code. xlogs checks what's live.
xlogs is a free, read-only security scanner that checks your live AI-built app for exposed keys, open databases and sensitive files, then shows the evidence and the steps to fix what it finds.
Claude
Codex
Lovable
Cursor
Bolt
v0
Replit
Supabaseand moreScan public websites across different stacks. Coverage depends on what the app exposes.
See what the xlogs security scanner finds
An illustrative report for a made-up app, so you can see a report before you scan. Every finding follows the same three steps: find it, fix it, verify it.
acme-vibesupabase.appPossible privileged key exposed in public JavaScript
- Seen
- A JWT whose decoded role claim is service_role (signature not verified) is in your client code at https://acme-vibesupabase.app/assets/app.js (eyJh••••••••ture (148 chars)).
- Not tested
- Whether it remains valid or what it authorizes: xlogs never uses a key.
- First fix step
- Contain and rotate the exposed key first.
- Build
- Deploy
- Scan
- Fix
- Recheck
- Ship
What does xlogs check?
11 checks, grouped here into 8 areas, with completion and coverage shown in each report.
Your site or app
The live deployment, as a visitor's browser sees it, for the problems listed below.
Scan a site or app →A GitHub repo
Any public repo, for install hooks, hidden payloads, committed secrets and exfiltration. It is never installed or run.
Scan a GitHub repo →Its tech stack
The framework, hosting, CDN, analytics and payments a site uses, from public signals, with the evidence shown.
See a site's tech stack →
On your site or app
Exposed keys
The HTML, inline scripts and up to 25 same-site bundles, for 18 key formats.
Check only for exposed keys →What it does not cover: Exposed keys
It never uses a key, so whether one still works is not tested.
Open databases
Your Supabase tables, asked as a logged-out visitor whether they return rows.
Check only your Supabase tables →What it does not cover: Open databases
It reads one row for column names and keeps no values. Hosted Supabase refuses the table list to public keys, so on a hosted project it cannot name a table and says so. Writes and Firebase rules are not tested.
Sensitive files
6 paths where sensitive files are often left (.env and its variants, .git, editor credentials), and the npm lockfile.
Check only for .env and .git files →What it does not cover: Sensitive files
What a file contains decides the finding: a credential in it is critical, configuration alone is graded lower, and a page that only looks like the file does not count. No other paths are guessed.
Source maps
Whether a published map turns your bundles back into the original source.
Check only for public source maps →What it does not cover: Source maps
A map that belongs to a public open-source library is listed, not flagged.
Credentials in the browser
Your served code, for a login token written to localStorage or sessionStorage, and your pages, for a password field a form would send in the address.
What it does not cover: Credentials in the browser
The session stores of documented auth libraries are not counted, and no form is ever submitted.
Security headers and cookies
5 protective headers and your cookie flags, on the homepage response.
Check only your security headers →What it does not cover: Security headers and cookies
A missing header is a missing protection, not proof an attack works.
Third-party scripts
The hosts you load scripts from, against CDNs with a documented compromise and well-known services a host may imitate, and integrity hashes on pinned files.
What it does not cover: Third-party scripts
A host that is not on the list and imitates no well-known service is named, never flagged.
DNS and email
A CNAME left pointing at a service you no longer own, SPF, DMARC and where its reports go, and the other names public certificate logs list.
What it does not cover: DNS and email
Those other names are inventory: listed, never tested.
xlogs looks at your deployment the way a visitor's browser does and reports what came back. It is not a penetration test, so it does not try injection, cross-site scripting or logging in. How each check works, and what it does not cover
See the sites that carry the xlogs badge. A badge records the date of a scan, not a guarantee. Scan yours, and if nothing urgent turns up you can add it.
Connect suspicious requests with what your app exposes.
Your logs show what was requested. A live scan shows what is exposed now. Together, they help you investigate where to look first.
Your log is read in your browser and never uploaded. Apache, nginx, Vercel, Cloudflare and JSON logs.
Open the full log analyzerPeople requested /.env, and the deployment serves it today.
A past request and an exposure today do not prove the file was exposed or accessed at the time.
Demonstration, computed from a sample log by the same parser your own file would use.
Also check code before you install it
Your AI tool suggested a package. Is it safe? Paste a public GitHub repo: xlogs reads it for credential access, hidden execution, exfiltration channels, install hooks and agent or MCP risks, and never installs or runs it.
Frequently asked questions
Free to scan. Nothing locked. No signup.
Is xlogs free, and what is included?
Yes, and nothing is locked. Every scan is free with no signup: you get all findings, fix instructions for each one to copy into your AI coding assistant, and free re-scans to check that a fix worked. The web scanner allows 60 scans an hour from one connection; the command line tool has no limit. There is no paywall on results.
What does xlogs check?
Mistakes that commonly ship in AI-built apps: a database anyone can read (Supabase row level security off), secret keys in the browser, missing security headers, exposed source maps, and sensitive files such as .env. Each finding comes with the evidence behind it.
Is it safe to scan my live app?
Every request xlogs sends is a GET or a HEAD, enforced in the code that sends it: it never submits a form, never logs in and never tries to exploit what it finds, and its crawl skips links that look like actions. Besides the pages and code a browser loads, it asks for a short published list of paths where sensitive files are often left, such as /.env. A badly built app can still change state on a GET, which a read-only scanner cannot rule out for you.
Which tools does it work with?
It scans public websites and web apps across different stacks, including ones built with Lovable, Bolt, v0, Replit, Base44 and Cursor, and apps that use Supabase. It reads the live site, so what a scan covers depends on what the app exposes: the database check, for example, needs a Supabase client in the code the page loads.
Does xlogs store my code or data?
It never keeps your code or the contents of your data. A scan fetches only what your app already serves publicly and sends the report back to you; it is not kept after that unless you choose something that keeps it: a share link, Watch or a verified badge. As evidence it records table and column names and an approximate row count, never row contents. Each scan also adds to anonymous counts that hold no URL or IP; the address being scanned is held for about three minutes so two scans of one site do not run at once, and your connection's address is counted for an hour to apply the scan limit. The privacy page lists everything kept and for how long.
Does xlogs use AI to scan?
No. The checks are rules, not a model: the same responses from your app produce the same findings under the same rule version, and every finding shows the response it came from. A live app can answer differently from one scan to the next, so a result describes the moment it ran. Fixes come from a fixed knowledge base, addressed to your coding assistant, not from a model guessing.
Check what your app is serving right now
Free, read-only and no signup. Paste a URL, read the evidence, and hand the fix steps to your coding assistant.
Scan your app free