Live in an hour. So are your API keys and customer data.
Ready.
Sources: Veracode, GenAI Code Security Report, Jul 30, 2025 · Escape, Oct 29, 2025 · NVD, CVE-2025-48757
Your sales team builds a customer portal with Bolt. Marketing ships a campaign page with Lovable or v0. Both go live in an afternoon, without a ticket to IT. To make the app work, API keys and database credentials often end up in the code that every browser downloads. Anyone who opens the page can read them.
That was all it took at the Moltbook platform. A Supabase key in the JavaScript opened a database with 1.5 million API tokens and 35,000 email addresses. Wiz needed no attack for that, just a normal visit to the site (Wiz, Feb 2, 2026).
Whether apps like these run in your company, your IT often doesn't know. Only 29% of German companies are sure their employees don't use private AI tools, and 23% have rules for them (Bitkom, Oct 21, 2025).
Hullwise sees your apps the way an attacker sees them, only sooner. You get every finding with where it was found and how to fix it. With Business we rescan every week, and your team gets an email as soon as a grade drops.
Everything below sits in the code the browser downloads. Hullwise shows it to you first, with where it was found and what to do next.
With a Supabase master key, an OpenAI key or a database password from the JavaScript, a stranger can read your customer data or run up charges on your account. Hullwise names the type and where it was found, shows the value only shortened and explains how to revoke the key.
If a Supabase table has no access rules (Row Level Security), every visitor can read the whole table. The scan flags when the browser talks to the database directly. Whether the rules hold is checked in the Security Audit.
If the app calls OpenAI or Anthropic without its own server, the key sits in the browser. Whoever copies it spends your AI budget, and the bill goes to you. A small server endpoint that holds the key closes the gap.
Known vulnerabilities are public, write-ups included. Anyone who spots an outdated version in your app knows where to start. Hullwise detects the versions of components such as Next.js or React and matches them against the vulnerability database OSV.dev. An update usually closes the gap.
With a Slack or Teams webhook from the code, anyone can post to your channels, for example a fake instruction to your team. A GitHub token leads to your source code. Hullwise also finds keys for Stripe, AWS, SendGrid and Twilio, and the guide shows how to replace them.
The report shows whether an app was made with Lovable, Bolt, v0, Replit or Base44, and where it runs, for example on Vercel or Netlify. That shows you which of your apps came out of an AI builder, including the ones your IT doesn't know about.
Every deployment can bring a new key into the code. Business rescans up to 10 domains every week. If a grade drops, your team gets an email. The history serves as evidence for auditors.
Your developers attach the scan to every deployment, via API or as an MCP server in Claude Code and Cursor.
GET /api/v1/scan?url=…&lang=en
→ 200 { "grade": "E" }Lovable places the responsibility for open databases on its customers (CVE-2025-48757). If an app from one of your departments leaks data, your company is liable.
If an exposed credential leads to a personal data breach, you have 72 hours to notify the supervisory authority. If the risk is high, you also have to inform the affected customers.
Hullwise shows you the leak so you can close it before anyone finds the data.
Source: Art. 33 and 34 GDPR
Germany's NIS2 law has been in force since Dec 6, 2025. Management must implement and oversee the security measures, and in case of culpable breach of duty it is personally liable to the company.
Hullwise gives you evidence for your NIS2 and GDPR obligations. Every scan stays in your history with its date and findings.
Source: BSI, Dec 5, 2025 · Section 38 BSIG
Anyone who finds an exposed OpenAI or Anthropic key can send their requests at your expense. GitGuardian counts 1,275,105 leaked keys for AI services, 81% more than the year before.
Hullwise detects keys for OpenAI, Anthropic, OpenRouter, Groq and xAI. You revoke the key with the provider and put the new one on the server.
Where shadow AI use was high, a data breach cost USD 670,000 more on average. On top of that comes the damage when customers learn from the press that their data was exposed.
Enter the addresses your departments use. Hullwise shows in seconds what is exposed in them.
Source: IBM, Cost of a Data Breach 2025
It opens your app like a browser and attacks nothing. It never uses keys it finds and never stores their full value. What sits behind the login we check by hand in the Security Audit.
You see the grade and the two most urgent findings right away. The full report costs €79 once, and every further check of the same domain €39.50. Business monitors up to 10 domains for €149 per month.
Hullwise sells to businesses only. All prices are final prices. As a German small business (§ 19 UStG) we charge no VAT.
A first look at one app
For companies with several apps and domains
For large groups, NIS2 entities and regulated industries
One app, one domain, and you know today what is exposed. You get every finding with steps to fix it, kept under a private link and as PDF.
Checking again later? Every further report for the same domain costs just €39.50.
The scan sees what is exposed from the outside. In the audit we check by hand what sits behind it, for example whether your database access rules hold and what happens behind the login.
More in the help center.
Your first scan is free. It shows the grade, the number of findings per area and the two most urgent findings in full.
The single report costs €79 once. You get the full report of exactly that scan, with every finding and the steps to fix it, kept under a private link and as PDF. Every further check of the same domain costs €39.50.
Business costs €149 per month, or €119 per month billed yearly. Up to 10 domains are scanned every week, and your team gets an email as soon as a grade drops. For now we set up Business for you personally, a short email to cem@cdcapital-group.com is all it takes. Enterprise starts at €490 per month, and the Security Audit starts at €1,500 per application.
All prices are final. As a German small business (§ 19 UStG) we charge no VAT.
No. The scan loads the page and the JavaScript files it includes, the same way any browser does. It also reads the certificate and two public DNS records of the domain.
We don't probe hidden paths, submit forms or log in anywhere. The full list is in What we don't check.
We name the type and where it was found and show the value only shortened, for example sk_live_…9f2A, so you can match it at the provider. We never show, store or use the full value.
You revoke the key with the provider and create a new one that lives only on the server. The report explains how for each provider. Then you scan again.
Ask marketing and sales for the links they send to customers or colleagues. Typical addresses end in lovable.app, vercel.app, netlify.app or replit.app.
You can scan each of them here in seconds. With Business you keep up to 10 of them under watch.
Only scan apps your company owns or that you have permission to check. The scan only reads what is publicly served, and the rule still applies. Details are in the acceptable use policy.
Hullwise gives you evidence for your NIS2 and GDPR obligations. Every scan is saved in your history with its date and findings. That documents the regular testing of your web applications required by Art. 32 GDPR and, in Germany, by Section 30 BSIG.
Whether your measures are sufficient overall is for your information security officer or legal counsel to assess.
Not necessarily. Grade A means nothing critical is exposed from the outside. An outside scan can't see whether the database access rules hold or what happens behind the login.
We check that by hand in the Security Audit, after you have shown that you own the domain.
Without an account, we don't store the result. With an account, it goes into your history. Results are never public and never show up in search engines.
That can happen, for example when a string only looks like a key or a version number appears only in a file name. That's why we label version findings "potentially affected". Report the case to us and we look at every one. More under False positives.
Claude Code can run a scan after every deployment
scan_websiteCursor can explain a finding and find the spot in your code
scan_websiteChatGPT can sum up the report for your leadership team
scan_websiteCodex can rescan once the fix is in
scan_websiteVS Code can show what the scan looks for
list_checksYou add one address as an MCP server, once, with no key and no account, up to 20 scans per hour. An assistant can't buy anything. The full report, Business and the audit are always booked by a person.
Hullwise finds the leaks before someone else does: exposed keys, database credentials and outdated software. Every finding comes with steps to fix it.
Click a finding to mark it as fixed.
Ship fast. Stay hullwise.