Decloak.dev

Eight core layers run on every scan, free tier included: HTTP and TLS security posture, static HTML analysis, rendered-page network behaviour, JavaScript CVE scanning, tag manager intelligence, third-party domain mapping, vibe-coded platform security (Supabase, Lovable, Base44, Bubble, and Next.js misconfigurations), and an AI-written executive summary that ties the findings together. Enterprise adds a ninth layer of active security testing (DAST), including systematic API endpoint discovery and testing (REST/GraphQL/SOAP); Starter and up add a tenth layer for DNS records, TLS certificate analysis, subdomain discovery, and subdomain takeover detection. See the How it works page for the full breakdown.

No. The free scan works on any URL with no login - paste it in and get a graded, shareable report in about 15 seconds. Creating a free account lets you save scans, see a dashboard across domains, and get a higher daily scan limit.

The scoreboard is the report-card grid that greets you when you log in, and every domain page has its own scoped to just that domain - security score, findings by severity, DNS/TLS posture, and more, all glanceable in one place. It's free on every account; upgrading adds more tiles (Active Testing, Compliance Controls, Team Activity) instead of hiding them - a tile you haven't unlocked yet shows as a locked teaser linking to the plan that includes it, rather than disappearing.

Decloak's free, Starter, and Pro scans perform passive, read-only analysis of publicly accessible pages - the same information any visitor’s browser receives. Enterprise's opt-in Active Security Testing goes further with safe, non-destructive active probes (forced browsing, CORS checks, reflected-input canaries) - it requires explicit per-scan consent, since it actively probes the target rather than just observing it. Either way, Decloak does not attempt exploitation or authentication bypass, and you’re responsible for having the right to scan a given target under your local laws and any applicable terms of service.

The free scan runs the core 8 layers once, on the single page you submit - including a check for Supabase, Lovable, Base44, Bubble, and Next.js misconfigurations. Paid tiers deploy an AI agent that keeps crawling and investigating - following scripts, source maps, tag manager containers, and linked pages - across up to 50 pages on Starter, 200 on Pro or Enterprise, then produce per-finding remediation guidance. Enterprise also adds active security testing (DAST) and authenticated scans behind a login.

Yes, on Pro and up. A REST API with OpenAPI/Swagger docs lets you trigger scans and poll results from your own tooling, and an MCP server lets Claude, Cursor, or any MCP-compatible AI agent do the same directly. Slack notifications and signed webhooks are also available. See the Integrations page for details.

Yes - a chat widget is available everywhere in the product. For guests and free-tier accounts it answers from a curated set of common questions with links to the right page. On any paid plan (Starter and up), it becomes a full LLM-backed assistant that can see the scan or report you're currently viewing, so you can ask it to explain a specific finding, walk through remediation, or find the right guide, without leaving the page.

AI app builders and no-code platforms - Lovable, Supabase used directly, Base44, Bubble, and similar - make it fast to ship an app, but they also make it easy to ship the same handful of recurring security mistakes. Decloak fingerprints which of these platforms a site is built on, then checks for the specific misconfigurations most commonly reported for that stack: a Supabase database left publicly readable because Row Level Security was never enabled, a Supabase service_role key accidentally shipped in client-side JavaScript, a Bubble Data API left open with no privacy rules, and known platform vulnerabilities like the Next.js middleware authorization bypass (CVE-2025-29927).

Yes, it runs on every scan regardless of how the site was built. If no known platform signature is detected, it simply reports "no known AI-builder platform signature found" as an informational, clean result - it never counts against your score.

It doesn't need one. A Supabase project's "anon" API key is meant to be public - it ships in your own site's JavaScript by design, and Row Level Security (RLS) is what's supposed to restrict what that key can read on a row-by-row basis. Decloak extracts the anon key and project URL your own site already exposes to every visitor, then checks a short list of common table names read-only - the same thing anyone else with your public key could do. If a table responds with data, RLS isn't configured correctly for it.