Scan for free

How Hullwise works

Hullwise checks websites and apps from the outside, the way every visitor sees them. That includes the JavaScript files where apps built with Lovable, Bolt or Cursor often expose keys. Here you can read what happens during a check, what a finding means for your business and how to fix it. If you run the check from your own code or an AI assistant, you’ll find everything technical in the developer docs.

Getting started

Your first checkEnter an address, read the result and see what to fix first.Securing vibe-coded appsThe gaps apps built with Lovable, Bolt, Cursor, Claude Code, Codex, v0 or Replit often have, what Hullwise finds and what to do right away when a key is exposed.How the grade is calculatedWhat earns points, what costs points and what it takes to get an A.What we don’t checkWhat a check reads from the outside, what it never does, what it therefore can’t see and when an audit is worth it.

Understanding findings

Browser security headersSix lines your server sends with every response. What each one protects against and which value to start with.HTTPS and certificatesWhether your site is reachable over an encrypted connection, when your certificate expires and what fixes a browser warning page.Protection against spoofed emailTwo records at your domain provider define who may send email in your name (SPF and DMARC).Outdated software with known vulnerabilitiesHow we detect versions, where our vulnerability data comes from and why the finding says “possibly affected”.What anyone can read in your codeAccess keys for databases, AI services and payments, error messages and other traces in your app’s HTML and JavaScript files.Securing cookiesWhat the Secure and HttpOnly attributes do and how to set them.Data protection check (GDPR)Google Fonts, tracking before consent, embedded content and legal notice: what we detect and how to fix it.Domain and DNSTakeover of dangling addresses, CAA, DNSSEC, security.txt, SPF lookups and MTA-STS.Technology detectionHow we see what your site is built with and where it runs, and how to reveal less of it.

Fixing

Setting headers by platformTemplates for Vercel, Netlify, Next.js, Cloudflare, nginx and Apache, plus what works on WordPress, Shopify, Lovable and Bolt.When a finding is wrongWhy a finding is sometimes off and how to report it to us.

Account & agents

API and AI assistantsRun the check from your own code, a pipeline or an AI assistant such as Claude or Cursor.Your dataWhat we store, what we never store and why there are no public result pages.

Frequently asked questions

Does Hullwise attack our site?

No. We load your homepage once, like a normal visitor, and fetch the JavaScript files it includes itself, the same way every browser does. We don’t probe paths, submit forms, log in anywhere or use any keys we find. Learn more

Does Hullwise find exposed keys in apps built with Lovable, Bolt or Cursor?

Yes, if they are in the app’s HTML or JavaScript files. That is where they usually end up in these apps. We name the type and where it was found and show the value only shortened, for example sk_live_…9f2A. We never show the full value. Whether the database has access rules is something a check from the outside can’t see. The audit covers that. Learn more

Can we check any site?

The check only reads what is public. Even so, only check sites your company runs or that you have a mandate for. We start an audit only after you have proven that you own the domain. Learn more

The app works fine. Why is the grade bad?

The grade measures what a stranger could exploit from the outside. Whether the app runs has no bearing on it. Exposed keys and missing security headers cost the most. On most platforms you can add the headers in a single file. Learn more

We use Shopify or Lovable. Can we fix this at all?

Partly. Shopify doesn’t let you set your own headers, so those deductions stay. You can still set up email protection for your domain yourself. With Lovable and Bolt it depends on the host: on Netlify or Vercel a template does it. Exposed keys can be fixed everywhere. Learn more

Another tool shows a different result. Which one is right?

Often both. Every tool weighs things differently and checks different things. On top of that, a service in front of your site such as Cloudflare can answer each request a little differently. Learn more

What do we do if a key was found?

Revoke the key with the provider right away and create a new one that lives only on the server. Deleting it from the code is not enough, because someone may already have copied it. Then check the logs and find out whether you have a duty to report the incident. Learn more

How often should we check?

After every release and regularly in between, because apps change and new vulnerabilities keep coming to light in existing software. The Business plan checks your domains every week and emails you as soon as a grade gets worse. Learn more

Do you store which sites we check?

Without an account, we don’t create any record of your check. With an account, every check goes into your private history. Keys we find appear there only shortened, and we never store the full value. There are no public result pages. Learn more

Is your app
watertight?

Hullwise finds the leaks before someone else does: exposed keys, database credentials and outdated software. Every finding comes with steps to fix it.

https://

Click a finding to mark it as fixed.

See pricingHow a scan works

Ship fast. Stay hullwise.