Frequently asked questions

Snytchr is a security scanner for apps built with AI tools. Start with a URL Scan to find public exposure, add a test account for an authenticated Deep Scan, or connect GitHub so Auto-Fix can turn findings into pull requests. Every issue is explained in plain English.

Vibe-coded apps are the ones you build by describing what you want to an AI builder — Lovable, Bolt, v0, Cursor, and the like. Snytchr is written for exactly that audience: every result is in plain English with a copy-paste fix, so you don't need a security background to understand it or act on it.

Snytchr is tuned for apps shipped with Lovable, Bolt, v0, Cursor, Claude, ChatGPT, Replit, Windsurf, Base44, Rork, Emergent, and IndigiCoder, and for Supabase and Firebase backends. But it works on any deployed web app — if it has a URL, Snytchr can scan it.

The free URL Scan returns your first verdict in about 30 seconds. A Deep Scan goes further — it logs in, crawls more of the app, and runs deeper checks — so it takes longer to finish.

No. The free scan needs nothing but your app’s URL — no signup, no code access. If you later want hands-off Auto-Fix, you can connect a GitHub repository through the Snytchr GitHub App and revoke that access anytime. More on how we handle this on the security page.

Yes. The free scan is read-only — it only looks at what your app already shows any visitor, and its probes test whether a door is open without walking through it. Nothing is changed, created, or deleted. See how we scan safely →

For a URL scan, only what’s publicly reachable: your pages, the JavaScript they load, and your public API responses. A Deep Scan additionally uses the test credentials you provide to check the signed-in experience. The security page covers this in detail.

Use a dedicated test account rather than a real user or admin login. Deep Scan uses those credentials in a real browser to crawl signed-in screens and test access controls, so the account should contain only data you are comfortable using for security testing.

Across its URL and authenticated scans, Snytchr checks more than 75 security areas covering authentication, authorization, secrets, databases, APIs, storage, infrastructure, and abuse protection. See the full list on What we scan.

Every scan produces a 0–100 readiness score and a launch verdict. Snytchr marks an app “Not safe to launch yet” if it finds any critical or high-severity issue, is missing an essential protection, or scores below 70 — the launch bar. Fix those issues and re-scan to see whether the verdict changes.

Free gives you the URL Scan score and issue list. The $29 Full Report unlocks the evidence and exact fix for every issue in that scan. Every Deep Scan includes its own complete report, and Studio adds Auto-Fix for turning fixable findings into GitHub pull requests.

For each unlocked finding, Snytchr writes the fix as a prompt tailored to your builder and stack — you paste it back into Lovable, Bolt, Cursor, or wherever you build. Then you re-scan, and Snytchr tests the same door again. Prefer it hands-off? Studio's Auto-Fix can open the change as a pull request for you.

Auto-Fix is the hands-off way to fix. Instead of handing you a prompt to paste, Snytchr connects to your GitHub repo, writes a patch for each fixable issue, and opens a pull request for you to review and merge. Auto-Fix is available on Studio and uses 10 credits per run.

No — and we're honest about that. A passing result reflects your app as scanned, at that moment, against the checks Snytchr runs. It's a strong signal you've cleared the common launch blockers, not a warranty or a substitute for a full professional audit of a high-stakes app.

Scanning and your verdict are always free. Unlock the full report and exact fixes for $29. To keep shipping, Continuous is $39/month (10 apps plus 40 credits) and Studio is $149/month (15 apps, Auto-Fix, and 100 credits). See pricing for the details.

The free URL Scan is outside-in and read-only: it inspects what your app exposes without logging in. A Deep Scan is authenticated: it signs in with your test credentials in a real browser, crawls the app, and tests risks such as whether one logged-in user can reach another user's data.

Credits are for deeper security work. URL scans, manual URL re-scans, and weekly URL checks are free. An on-demand or scheduled Deep Scan costs 4 credits, and an on-demand or scheduled Auto-Fix costs 10. Continuous includes 40 credits a month and Studio includes 100.

Weekly URL checks are free. A scheduled Deep Scan uses 4 credits and a scheduled Auto-Fix uses 10 — the same as running either one on demand. If there aren't enough credits when a premium scheduled run is due, that run is skipped.

Yes. Continuous and Studio are month-to-month, and you can manage or cancel anytime from the billing portal in your dashboard.