Security scanner for Claude Code apps
Claude Code writes and edits the code on your machine; you deploy the result. This scanner checks that result: the live, deployed app. It looks for what survives into production, like a key that ended up in the browser bundle or a database that answers anonymous requests, and it hands back fix instructions to paste into Claude Code.
Scan your deployed app
What it means
A value shaped like a private key or password is in code your site serves, where anyone can read it. If it still works, anyone who copies it can act as you: run up bills, read your data, or send email in your name. xlogs did not test it.
Why AI tools cause it
AI coding tools often paste an API key straight into a file to make something work, instead of hiding it in a private environment variable. It runs fine, so nothing warns you.
How xlogs checks it
xlogs scans your live JavaScript against 18 key formats covering Stripe (live, test and webhook secrets), OpenAI, Anthropic, AWS, Google, GitHub, Slack, private key blocks, and Supabase server keys (service_role and sb_secret_).
What to check on a Claude Code app that is live
An agent that can edit your whole project moves quickly, and speed is where deployment mistakes come from: a secret placed where the browser can read it, a database call with no access rules behind it, a build that ships source maps. Reading the code will not tell you which of those actually reached production. Scanning the deployed site will.
This checks your live URL only. Source-level issues such as SQL injection or unsafe HTML are found by reading code, not by fetching a deployed page, so they are a separate job from this scan and xlogs does not claim them.
The fix comes back addressed to Claude Code
Every finding carries a remediation prompt addressed to the tool you already use. Claude Code is the default target in the fix block, so the path is: scan the deployed app, copy the fix, paste it into Claude Code, redeploy, then rescan to see whether the finding is still detected.
The top issues to check on a deployed Claude Code app
- An API key or service key exposed in the client bundle
- A database table that returns rows to anonymous requests
- Missing security headers (CSP, HSTS, X-Frame-Options)
- Public source maps or private files served from the live site
How to fix it
The goal: The exposed key has been replaced and revoked at the provider, because removing it from the code does not stop it working, and the new value is stored only in a server-side secret or environment variable, never in code or the client bundle.
- Contain and rotate the exposed key first, because removing it from the code does not stop it working: if you suspect it is being misused, revoke it at the provider now; otherwise create a replacement, put it in the app's server-side secret settings, confirm the app works with it, and then revoke the exposed key promptly
- Remove the literal value from the code and any client-side bundle (the affected spot), so the key is read only from a server-only environment variable
- Make sure the .env file is in .gitignore
- Clear the old value from deployed builds and caches, and from the repository's history where you can; once the key is revoked, a copy left there no longer works
In my app (the spot the scan shows): a credential-shaped value is publicly served. Please make this true: The exposed key has been replaced and revoked at the provider, because removing it from the code does not stop it working, and the new value is stored only in a server-side secret or environment variable, never in code or the client bundle. Steps: Contain and rotate the exposed key first, because removing it from the code does not stop it working: if you suspect it is being misused, revoke it at the provider now; otherwise create a replacement, put it in the app's server-side secret settings, confirm the app works with it, and then revoke the exposed key promptly; Remove the literal value from the code and any client-side bundle (the spot the scan shows), so the key is read only from a server-only environment variable; Make sure the .env file is in .gitignore; Clear the old value from deployed builds and caches, and from the repository's history where you can; once the key is revoked, a copy left there no longer works. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Then verify: After you deploy the fix, xlogs re-scans your live app and reports whether the key is still found in what it reads. That cannot show the old key was revoked, so revoke it at the provider either way.
Full step-by-step fix guide, with a copy-paste block for each AI tool →
Common questions
Can xlogs scan my local Claude Code project?
Not the local project. This web scanner checks a deployed URL, so point it at your live app once it is online. For source code, xlogs has a separate GitHub repository scanner that reads a public repo statically without running any of it.
Why check the live app when Claude Code can read my whole codebase?
Some problems only exist after a build. Which environment variables ended up inlined in the browser bundle, whether source maps shipped, and how your database actually answers an anonymous request are all properties of the deployment, not of the source. The live scan sees what a visitor sees.
Does the fix work with Claude Code specifically?
Yes. Claude Code is the default target in every fix block, so the remediation is written as an instruction it can act on directly, naming the file or setting to change. Lovable, Cursor, Codex and a plain do-it-yourself version are one click away on the same finding.