Decloak - Web security intelligence
Scans a URL for exposed keys and CVEs free, sells deeper pentest and compliance evidence
Decloak scans a URL in 15 seconds for free and checks JavaScript CVEs, exposed Stripe/Supabase keys, hidden trackers, and missing CSP headers, correlating findings across layers that single-purpose scanners miss. Deeper checks — subdomain takeovers, TLS expiry, GraphQL introspection, full agent-driven pentesting behind a login — require paid tiers, and each finding on the site is explicitly marked Free, Starter+, or Enterprise. It specifically targets apps built with Lovable, Supabase, and Bubble, where Row Level Security often gets left off by default.
What holds up
- +Free scan needs no account and returns results in 15 seconds
- +Marks every finding as Free, Starter+, or Enterprise so you know what you're not seeing
- +Checks for the specific misconfigurations known to affect Lovable, Supabase, and Base44 apps
Mind the limits
- −Subdomain, TLS, and full pentest checks are locked behind paid Starter+ and Enterprise tiers
- −Free scan only covers a single page — a full site needs a paid agent scan
Picked here? Add the badge
Put it on your site. It links back to this page. Free for every listed product.
<a href="https://stillworks.dev/products/p/decloak-web-security-intelligence/"><img src="https://stillworks.dev/badge/decloak-web-security-intelligence.svg" alt="Picked by StillWorks" width="230" height="54"></a>