Which stacks does keysnag support?

Next.js and Supabase apps deployed on Vercel today. Other stacks get a clean skip rather than a false result.

Why not just ask Claude or Cursor to audit my code?

Do that too. An AI review only sees code and can be talked into approving it. keysnag is deterministic, gives the same result every run, and also checks your live site, your real RLS policies, and whether one user can actually read another user's data through your API.

What if keysnag flags something that is fine?

Add it to the allow-list with a reason and the control that bounds it. The finding stays in the report as info and never blocks. Every rule was tuned on a real production codebase to keep false positives near zero.

Cybersecurity for AI founders and vibe coders.

The pre-push security gate for apps built with Claude Code, Cursor, Codex, Lovable and Bolt.

12 checks, under 10 seconds
Free and open source (MIT)
Nothing leaves your machine
Never prints a secret
Blocks the push only on critical
Git hook, Claude Code plugin, MCP

$npx keysnag scan

or gate every push

your-app · git push

$ git push origin main

keysnag 12 checks · 1,376 files · 6.8s

● CRITICAL Supabase service_role key found

lib/supabase.ts:10 eyJh…9ckE (219 chars)

fix: rotate it, load it server-side only

keysnag blocked: 1 critical. Push declined.

$ git push origin main # after the fix

keysnag 12 checks · 1,376 files · 6.5s

✓ no critical findings push accepted

10 advisories saved to keysnag.report.md

Try this before you ship anything

The most common leak in AI-built apps takes thirty seconds to find by hand.

Make two accounts in your app, A and B.
Sign in as A and create something: a post, an order, a saved item.
Sign in as B, find the request that loads A's thing, and swap in A's id.

If B gets A's data back, any signed-up user can read everyone's data. It passed your tests because your test data only ever had one user. The model wrote a login check and skipped the check that the row belongs to you. keysnag runs this test against your real Supabase API for you.

What it checks

Twelve checks, each aimed at a mistake that has breached real AI-built apps. A critical finding blocks the push; everything else goes into a report you can read later.

In your code, no setup

secretsKeys and service_role JWTs in your repo and in the JS bundle you ship.
configSecrets in NEXT_PUBLIC_*, TLS checks switched off, CORS * with credentials, weak tokens.
authzRoutes that hit the database with no auth check, and /admin pages hidden only in the UI.
injectionSQL built from strings, user data rendered as HTML, eval, shell commands, SSRF.
paymentsStripe webhooks that never check the signature, and prices taken from the client.
backdoorObfuscated eval, hardcoded password bypasses, env dumps, calls to tunnels and paste sites.
ai-endpoints (warns only)LLM keys in the browser, AI routes with no auth or spend limit, unsafe model output.
depsKnown CVEs for the exact versions in your lockfile, with the version that fixes each one.

Against your live app, optional

twoaccountProves whether user B can read or edit user A's rows through your real API, without changing data.
rlsRow Level Security off, USING (true) policies, and policies that check login but not ownership.
storagePublic storage buckets, open storage policies, and cron routes with no secret.
urlprobe (warns only)Exposed .env or .git files, open admin pages and missing security headers on your live site.

The live checks need your site URL, a read-only database role, or two test logins in a local .env. Each one skips cleanly until you add it.

How it works

It is a plain git hook, not an editor extension, so it behaves the same in Cursor, VS Code, a terminal or CI.

Your agent writes code

Claude Code, Cursor, Codex, Lovable, Bolt, v0 or Replit.

git push

The pre-push hook fires.

keysnag checks it

Twelve checks in under ten seconds, secrets always masked.

Clean code ships

The push goes through. Advisories are saved for later.

● Critical finding: the push is blocked and the fix goes back to your agent

First run on a real production app: 144 findings. After tuning every rule: 16, all genuine, none of them a false critical.

Scanners that cry wolf get switched off. No rule in keysnag is allowed to block a push until it has run on a real codebase with zero false positives. Three rounds of independent review then tried to break it.

DeterministicRules and live probes, not a model guessing. Same answer every run.
Local onlyNo telemetry. It talks to what you point it at, plus one optional CVE lookup.
Never prints a secretEvery value is masked to its first and last four characters.
Exceptions need a reasonAn allowed finding records why it is fine and what limits the risk.

Install

Needs Node.js 22 or newer. The code checks work with no setup.

terminal

# scan the current project once

$ npx keysnag scan

# block risky pushes from now on (keeps any hook you already have)

$ npx keysnag install

# Claude Code: auto-runs on commit and push, adds /security-check

$ claude plugin marketplace add Sheldon-desouza/keysnag

$ claude plugin install keysnag@keysnag

# MCP server for Cursor, Codex and Claude Desktop

$ npx keysnag-mcp

Questions

Is keysnag free?

Yes. It is open source under the MIT licence and free to use, including commercially.

Does my code leave my machine?

No. keysnag runs locally with no telemetry. It only contacts the site, Supabase project or database you configure, plus one optional call to OSV.dev for known-vulnerability data, which you can turn off with --no-osv.

Is this a penetration test?

No. keysnag catches the defect classes behind most real breaches of AI-built apps. It is not a substitute for a professional security review, and it will never tell you your app is unhackable.

Which stacks does it support?

Next.js and Supabase apps on Vercel today. Other stacks get a clean skip rather than a false result.

Why not just ask Claude or Cursor to check my code?

Do that too. An AI review only sees code and can be talked into approving it. keysnag gives the same answer every run, and it also checks your live site, your real RLS policies, and whether one user can actually read another user's data.

What if it flags something that is fine?

Add it to the allow-list with a reason and the control that limits the risk. It stays in the report as information and never blocks. If a rule is simply wrong, open an issue with the line that fired.