Cobalt Owl

Find the leaks in your AI‑built app first

We check what your Lovable, Bolt or Cursor app exposes publicly, and give you the prompt that fixes it.

Example: yourapp.lovable.app14 checks, 3 issues to fix
62out of 100
Supabase table readable by anyoneprofiles: 1,284 rows, RLS off
Fix prompt
OpenAI key in your JavaScriptsk-pro••••••••Q3x in /assets/index.js
Fix prompt
No Content-Security-PolicyInjected scripts can run freely
Fix prompt
No .env or .git files onlineChecked /.env, /.env.local, /.git/config
You confirm ownershipNo scan runs without it.
Read-onlyNo logins, forms or attacks.
Secrets stay maskedWe never store a full key.
Delete anytimeOne email removes your data.

What a scan looks for

The mistakes AI builders make most often, checked from the outside, the way a stranger sees your app.

Keys in your codeStripe, OpenAI, Anthropic, AWS, GitHub and Supabase service keys shipped to the browser.Critical if found
Your databaseSupabase tables anyone can read with the public key. We count rows and read none.Critical if found
Files left online.env, .git and source maps published with your live site.Critical if found
HTTPSEvery visit encrypted, with HSTS so browsers never fall back.Medium if found
Browser protectionsContent-Security-Policy, clickjacking, nosniff and referrer headers.Medium if found
CORS and cookiesWhether other sites can call your app as your users, and how session cookies are set.High if found

From address to fixed in three steps

1

Paste your app's address

Your deployed app, like yourapp.lovable.app or your own domain.

2

Confirm it's yours

Tick the box to confirm you own the site or may test it. The scan takes under a minute.

3

Paste the fix

Every issue comes with a prompt for Lovable, Cursor or Claude Code. Run the scan again to confirm.

Every finding comes with its fix

Example data, in the exact format your report uses.

Critical

Supabase table readable by anyone

Your app ships a public Supabase key, which is normal. Row Level Security is off on this table, so anyone with that key can read every profile.

Found: profiles, 1,284 rows. We counted them and read none.

Paste into Lovable or Cursor

The profiles table in Supabase is readable by anyone with the anon key. Enable Row Level Security on it and add policies so a signed-in user can only select and update their own row (auth.uid() = id). Show me the SQL and check that nothing in the app breaks.

Pricing

The scan is free. Pay only for the full report or ongoing checks.

Free scan

$0

See where you stand.

  • All six check groups
  • Score and issue list
  • A fix prompt for every issue
Scan my app

Full report

$9 one-time

For a launch or a client handoff.

  • Everything in Free
  • Downloadable PDF report
  • A re-scan after you fix
Join the waitlist

Monitor

$19 / month

For an app with real users.

  • Weekly scans of one app
  • Email when a new issue appears
  • Scan history
Join the waitlist

Studio

$49 / month

For builders shipping for clients.

  • Up to 10 apps
  • Daily scans
  • Reports to share with clients
Join the waitlist

Paid plans open soon. The waitlist is free.

How we handle what we see

A security tool should be careful with your data. These are the rules the scanner follows.

Only what's public

We request the pages and files any visitor's browser can load. Nothing behind a login.

Keys are masked

Found keys show only their first and last characters. We never store a full key.

Counts, not contents

For open tables we ask the database for a row count. We never download rows.

90-day retention

We keep the host, score and number of issues for 90 days, then delete them.

Delete on request

Email privacy@cobaltowl.dev and we remove your scans and waitlist entry.

Report a problem

Our security contact is in security.txt.

Questions

Is a scan safe to run on my live app?

Yes. Every check is a normal read request, like a visitor loading your site. We don't submit forms, log in, or send attack payloads.

Can I scan a site that isn't mine?

No. You must own the site or have permission to test it, and you confirm that before every scan. Scans are rate-limited.

Does a good score mean my app is secure?

No. It means the issues we check for weren't visible from the outside. It isn't a penetration test or a code review.

Which builders does it work with?

Any deployed website. The fix prompts are written for Lovable, Bolt, Cursor and Claude Code, and the database checks matter most for apps on Supabase.

Who runs Cobalt Owl?

Cobalt Owl is operated by Organic Media Buying LLC, a US company.

Get told when something new appears

Monitor scans your app every week and emails you about new issues. Join the waitlist and we'll let you know when it opens.