Is your Claude Code app secure once it is live?
Claude Code writes and edits the code on your machine; you deploy the result. This scanner checks that result: the live, deployed app. It looks for what survives into production, like a key that ended up in the browser bundle or a database that answers anonymous requests, and it hands the fix back in the form Claude Code can act on.
Scan your deployed app
What it means
A password-like key that is supposed to stay private is sitting in your app where other people can find it. Anyone who copies it can act as you — run up bills, read your data, or send email in your name.
Why AI tools cause it
AI coding tools often paste an API key straight into a file to make something work, instead of hiding it in a private environment variable. It runs fine, so nothing warns you.
How xlogs checks it
xlogs scans your live JavaScript against 9 key formats covering Stripe, OpenAI, Anthropic, AWS, Google, GitHub, Slack, private key blocks, and Supabase service_role tokens.
What to check on a Claude Code app that is live
An agent that can edit your whole project moves quickly, and speed is where deployment mistakes come from: a secret placed where the browser can read it, a database call with no access rules behind it, a build that ships source maps. Reading the code will not tell you which of those actually reached production. Scanning the deployed site will.
This checks your live URL only. Source-level issues such as SQL injection or unsafe HTML are found by reading code, not by fetching a deployed page, so they are a separate job from this scan and xlogs does not claim them.
The fix comes back written for Claude Code
Every finding carries a remediation prompt addressed to the tool you already use. Claude Code is the default target in the fix block, so the path is: scan the deployed app, copy the fix, paste it into Claude Code, redeploy, then rescan to confirm the finding is gone. That last step is the one most scanners leave out.
The top issues to check on a deployed Claude Code app
- An API key or service key exposed in the client bundle
- A database that returns private rows to anonymous requests
- Missing security headers (CSP, HSTS, X-Frame-Options)
- Public source maps or private files served from the live site
How to fix it
The goal: The key is stored only in a server-side secret / environment variable, never in code or the client bundle, and the exposed value has been rotated (regenerated) because the old one is public.
- Move the key's value into a server-only environment variable
- Remove the literal value from the code and any client-side bundle (the affected spot)
- Make sure the .env file is in .gitignore
- Rotate (regenerate) the key at the provider — assume the old one is compromised
In my app (the spot the scan shows): a secret key is exposed. Please make this true: The key is stored only in a server-side secret / environment variable, never in code or the client bundle, and the exposed value has been rotated (regenerated) because the old one is public. Steps: Move the key's value into a server-only environment variable; Remove the literal value from the code and any client-side bundle (the spot the scan shows); Make sure the .env file is in .gitignore; Rotate (regenerate) the key at the provider — assume the old one is compromised. Then tell me exactly what you changed, and do not print any secret values back to me.
Then verify: After you deploy the fix, xlogs re-scans your live app and your files and confirms the key is no longer present.
Full step-by-step fix guide, with a copy-paste block for each AI tool →
Common questions
Can xlogs scan my local Claude Code project?
Not the local project. This web scanner checks a deployed URL, so point it at your live app once it is online. For source code, xlogs has a separate GitHub repository scanner that reads a public repo statically without running any of it.
Why check the live app when Claude Code can read my whole codebase?
Some problems only exist after a build. Which environment variables ended up inlined in the browser bundle, whether source maps shipped, and how your database actually answers an anonymous request are all properties of the deployment, not of the source. The live scan sees what a visitor sees.
Does the fix work with Claude Code specifically?
Yes. Claude Code is the default target in every fix block, so the remediation is written as an instruction it can act on directly, naming the file or setting to change. Lovable, Cursor, Codex and a plain do-it-yourself version are one click away on the same finding.