# SetRepo

> SetRepo is a security scanner for web apps, including apps built with AI coding tools. It checks an app's code and its live site for problems like leaked API keys, open database rules, missing access control and vulnerable dependencies, and gives a fix for every finding.

- What you can scan: a GitHub repo (read-only access: SetRepo never writes to your code), a zip upload, or only a live URL when you don't want to share the code.
- What it checks: 106 checks across access control, business logic, secrets, injection, dependencies, infra & config, live site.
- Quick scan: runs every deterministic check. See pricing for current allowances. On the Free plan you see the A–F grade, the counts and every finding's title and severity, plus full details for a few top findings.
- Deep scan: everything in a Quick scan plus an AI review of access control and business logic, and the full report: file, line, exploit and fix for every finding, copy-paste fix prompts for AI coding agents, and a PDF.
- Live site only: checks HTTPS, security headers, cookies, DNS and email records, and the JavaScript the site serves. With a verified domain it also looks for exposed files and Supabase or Firebase data that can be read without signing in. It can't check API routes, sign-in, database rules or dependencies without the code.
- Results are information to act on, not a guarantee: no scanner catches every issue, and each report says what was and wasn't checked.

## Pricing (USD)

- Free: $0, 100 credits/month for Quick and URL scans.
- Deep scan: $2.99 one-time per scan, $6.99 for large repos. Includes one free rescan of the same project within 7 days.
- Starter: $19.99/month or $191.90/year. 1,200 credits/month.
- Pro: $44.99/month or $431.90/year. 3,000 credits/month.
- A Deep scan of unchanged code isn't run or charged again, on any plan. Details: https://setrepo.com/pricing

## Key pages

- [Home](https://setrepo.com/): what SetRepo does and how a scan works
- [Pricing](https://setrepo.com/pricing): plans, prices and the pricing FAQ
- [All checks](https://setrepo.com/checks): every check SetRepo runs, by category
- [Free website security scanner](https://setrepo.com/website-security-scanner): start a free live URL scan; coverage, example findings and limitations
- [Guides](https://setrepo.com/resources): how scans, grades and fix prompts work
- [Security](https://setrepo.com/security): where your code goes during a scan, when it's deleted, what is stored, and what a Deep scan sends to Anthropic
- [Accuracy](https://setrepo.com/accuracy): what each scan checks, what it doesn't, and how SetRepo is tested
- [FAQ](https://setrepo.com/faq): is SetRepo safe, does it store your code or send it to AI, and how accurate is it
- [Contact](https://setrepo.com/contact): support@setrepo.com

## Check guides

- [IDOR (insecure direct object reference)](https://setrepo.com/checks/idor): Change one number in a URL and see someone else's data. It's the most common way logged-in users read what isn't theirs.
- [Exposed secrets & API keys](https://setrepo.com/checks/exposed-secrets): A key in your code or git history works for whoever finds it. Deleting it later doesn't help; rotating it does.
- [Supabase RLS misconfiguration](https://setrepo.com/checks/supabase-rls): With Row Level Security off, your public anon key can read every row. One SQL line turns it back on.
- [Missing auth on admin routes](https://setrepo.com/checks/missing-admin-auth): An admin endpoint that nobody linked to is still on the internet. If it doesn't check who's calling, anyone can use it.
- [SQL injection](https://setrepo.com/checks/sql-injection): Gluing user input into a SQL string lets that input rewrite the query. Parameterized queries stop it completely.
- [Client-trusted prices](https://setrepo.com/checks/client-trusted-prices): If the checkout reads the total from the request, the buyer decides what they pay. Prices belong on the server.
- [CORS misconfiguration](https://setrepo.com/checks/cors-misconfiguration): Allowing any origin with credentials lets other websites act as your signed-in users. List the origins you trust instead.
- [Vulnerable dependencies](https://setrepo.com/checks/vulnerable-dependencies): Most of your app is code you didn't write. A package with a known vulnerability is a known way in until you upgrade it.
- [Firebase security rules open to anyone: how to check and fix them](https://setrepo.com/checks/firebase-rules-open): Your Firebase API key isn't the secret, your rules are. Test-mode or open rules let anyone read and change everything.
- [Supabase service_role key exposed in the browser: what it means and how to fix it](https://setrepo.com/checks/supabase-service-role-key-exposed): The service_role key skips Row Level Security completely. If it's in your browser code, anyone can read, change or delete all of your data.

## For builders

- [Security scan for Lovable apps: what to check before you launch](https://setrepo.com/for/lovable): Lovable apps usually pair a React and Vite frontend with Supabase. Most of their security problems are in that connection: RLS, keys and server functions.
- [Security scan for apps built with Cursor: the mistakes AI code makes](https://setrepo.com/for/cursor): AI-written code tends to repeat the same security mistakes: hardcoded keys, API routes with no auth check, and prices and IDs trusted from the browser.
- [Security scan for Replit apps: what to fix before you deploy](https://setrepo.com/for/replit): Replit apps are usually a full-stack Node or Python server with a database. Their security problems sit in that server: keys, unprotected routes and SQL.
- [Security scan for Base44 apps: what to check before you go live](https://setrepo.com/for/base44): Base44 apps can have the same problems as other AI builders: open API endpoints, secrets in client-side code and database access without proper rules.

## Guides

- [What is a vulnerability scanner, and what can it detect?](https://setrepo.com/guides/vulnerability-scanner): Learn how code, dependency and website scanners differ, how to interpret findings, and why scanning does not replace a penetration test.
- [SAST tools: what static code scanning can catch](https://setrepo.com/guides/sast-tools): Understand static application security testing, the code analysis in SetRepo, and the checks that need live systems or human review.
- [What is an AI code security scanner?](https://setrepo.com/guides/what-is-an-ai-code-security-scanner): Understand AI-assisted security review, how it differs from scanning AI-generated code, and where SetRepo's Quick and Deep scans fit.
- [How to scan a GitHub repository for security vulnerabilities](https://setrepo.com/guides/scan-github-repository-for-security-vulnerabilities): Choose public or private repository access, run a scan, review the evidence and rescan your fixes without granting write access.
- [Website security checker: find and review common issues](https://setrepo.com/guides/check-website-for-common-security-issues): A focused guide to what a live URL scan can observe, what its findings mean, and when to add source code or manual access testing.
- [How to check if your website is secure](https://setrepo.com/guides/how-to-check-website-security): Check your live site, review the code behind it, and test access with two accounts. A practical walkthrough with examples and next steps.
- [Website security checklist before launch](https://setrepo.com/guides/website-security-checklist): A pre-launch checklist with a concrete pass condition for each check: secrets, access control, database rules, payments, dependencies and recovery.
- [AI-generated code security risks: what your copilot won't warn you about](https://setrepo.com/guides/ai-code-security): AI tools write code that works but doesn't think about who else can call it: endpoints with no auth, secrets in public variables and logic that trusts the browser.
- [How to secure your database: Supabase RLS, Firebase Rules, and what AI builders get wrong](https://setrepo.com/guides/secure-database): AI builders turn off Row Level Security or write permissive rules to get things working and never tighten them. How to check Supabase RLS and Firebase rules.
- [Supabase RLS Disabled: How to Check and Fix It (2026)](https://setrepo.com/guides/supabase-rls-disabled-how-to-check-and-fix): With Row Level Security off, anyone holding a Supabase project's public anon key can read or change that table. How to find every open table and lock it down with policies.

## Using SetRepo

- [Most common mistakes](https://setrepo.com/resources/common-mistakes): The security mistakes that show up most in fast-shipped and AI-built apps.
- [Quick vs Deep scans](https://setrepo.com/resources/quick-vs-deep): What each one checks, what it costs, and when rescans are free.
- [Fix prompts: how to use them](https://setrepo.com/resources/fix-prompts): Hand a finding to your AI coding agent, safely.
- [How grades work](https://setrepo.com/resources/grades): A to F from the critical and high findings, and what counts.

## Optional

- [Full text for LLMs](https://setrepo.com/llms-full.txt): this file plus the Security, Accuracy and FAQ pages in full, and a summary and FAQ for every check guide and builder page
- [Terms of Service](https://setrepo.com/terms): The terms for using SetRepo's security scans: what you may scan, your code and reports, what results mean, payments and liability.
- [Privacy Policy](https://setrepo.com/privacy): What SetRepo collects, who handles it, how long it's kept, and how to export or delete it.
- [Refund Policy](https://setrepo.com/refunds): Refunds for Deep scans and subscriptions, the free rescan when a scan fails on our side, and how to ask.