Decloak.dev

Decloak (decloak.dev) is a web security intelligence tool built for developers, indie hackers, small businesses, agencies, and compliance teams. It scans a live URL across 8 attack surfaces — exposed API keys and secrets in JavaScript bundles, missing security headers (CSP, HSTS, etc.), known CVEs in outdated JS libraries, DNS/TLS misconfigurations, hidden trackers, and platform-specific misconfigurations common to AI app builders like Supabase, Lovable, and Base44 (most notably, publicly readable databases from disabled Row Level Security).

The free tier requires no account or card and returns a graded A-F report with an AI-written executive summary in under 15 seconds. Paid tiers add full-site agent investigation, scheduled recurring scans, PDF evidence exports, ISO 27001/SOC2 control mapping for compliance teams, and Enterprise-tier active security testing (DAST).