Skip to main content
Glama
Othm1ne

appsecradar

by Othm1ne
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

🛡️ appsecradar

Find the security holes your AI left behind.

A zero-config security scanner for apps built with Cursor, Claude Code, Lovable, Bolt, v0 & Copilot. It catches the mistakes AI coding tools make most, explains them in plain English, and gives you a fix prompt you can paste straight back into your AI editor.

npx appsecradar

Why

AI can build a full SaaS in a weekend. It also happily:

  • puts your OpenAI key in a React component

  • names your Supabase service_role key NEXT_PUBLIC_… so it ships to every visitor

  • creates Supabase tables without Row Level Security, so anyone with your anon key can dump your users

  • writes Stripe webhooks that never verify the signature, so anyone can fake a payment

  • generates API routes that never check who is calling

Generic security scanners are built for security teams. appsecradar is built for the person who just shipped with AI and wants to know: is this safe to launch?

Related MCP server: supership-scan

Quick start

# scan the current project
npx appsecradar

# scan a specific folder
npx appsecradar ./my-app

# try it on our intentionally broken demo apps
git clone https://github.com/Othm1ne/appsecradar && cd appsecradar
npm install && npm run build
npx appsecradar examples/vulnerable-vibe-app      # Next.js + Supabase + Stripe
npx appsecradar examples/vulnerable-express-app   # Express + Postgres
npx appsecradar examples/vulnerable-python-app    # Flask + FastAPI
npx appsecradar examples/vulnerable-firebase-app  # React + Vite + Firebase

Works with your stack

appsecradar auto-detects your stack and needs no config.

Supported

Frontend / fullstack

Next.js, React, Vite, Vue, Nuxt, SvelteKit, Astro, Remix / React Router, Angular, Expo / React Native

Backend

Express, Fastify, Hono, Koa, NestJS, Flask, FastAPI, Django, Laravel / PHP, Go, Rails (secrets + SQL)

Data & services

Supabase, Firebase (Firestore + Realtime DB), PostgreSQL, MySQL, MongoDB, Prisma, Stripe, OpenAI, Anthropic

Mobile

Flutter, Swift, Kotlin / Android (secrets shipped in the app)

What it checks

Rule

Severity

Catches

hardcoded-secret

critical / high

15+ key types (OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase, Groq, Hugging Face, Resend, SendGrid, Slack, Twilio, private keys) and database URLs with real passwords. Critical when the code ships to browsers or phones

public-env-secret

critical

Secrets behind NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_, NUXT_PUBLIC_, PUBLIC_

supabase-rls-disabled

critical

Public tables without (or with disabled) Row Level Security

firebase-open-rules

critical / high

if true rules, test-mode rules, "any logged-in user can access everything", open Realtime DB

stripe-webhook-unverified

critical

Webhooks that never verify the Stripe signature (Node, Python, PHP, Ruby, Go)

api-route-missing-auth

high

Write endpoints with no auth check in Next.js, SvelteKit, Nuxt, Remix, Astro, Express, Hono, Fastify, Koa, Flask and FastAPI

sql-injection

high

SQL built with string interpolation in JS/TS, Python, PHP, Go and Ruby

cors-any-origin-credentials

high

CORS that reflects any origin with credentials (Express, FastAPI, Flask)

debug-mode-enabled

high / medium

Flask debug=True, Django DEBUG = True, Laravel APP_DEBUG

Let your AI editor fix it (MCP)

appsecradar ships an MCP server, so Cursor, Claude Code, Windsurf or VS Code can scan your project, fix the issues and verify each fix by re-scanning.

Claude Code

claude mcp add appsecradar -- npx -y appsecradar mcp

Cursor: .cursor/mcp.json

{ "mcpServers": { "appsecradar": { "command": "npx", "args": ["-y", "appsecradar", "mcp"] } } }

VS Code: .vscode/mcp.json

{ "servers": { "appsecradar": { "type": "stdio", "command": "npx", "args": ["-y", "appsecradar", "mcp"] } } }

Then ask your agent: "Use appsecradar to secure my app", or run the built-in secure_my_app prompt.

MCP tool / prompt

What it does

scan

Scans a folder (optionally only some files or a min_severity) and returns findings with exact fix instructions

list_rules

Lists every check and why it matters

secure_my_app (prompt)

Scan → fix critical issues one by one → re-scan to verify → list keys to rotate

The server is read-only: it never edits files itself, and it tells the agent never to rotate keys on your behalf.

Every finding comes with a fix prompt

 CRITICAL  Table "notes" has RLS never enabled
 supabase/migrations/20250101000000_init.sql:12  [supabase-rls-disabled]
   Anyone who copies the anon key from your website can run
   supabase.from("notes").select("*") and dump, edit or delete every row.
   Fix prompt (paste into your AI editor):
     Write a new migration that runs: alter table public.notes enable row level security;
     then add policies so users can only access their own rows ...

CI usage

npx appsecradar --fail-on high      # exit 1 on high or critical findings (default)
npx appsecradar --json > report.json

Options

--json               Print findings as JSON
--markdown           Print findings as Markdown (handy for PR comments)
--fail-on <level>    critical | high | medium | low | none   (default: high)
--no-color           Disable colors

Ignore a deliberate finding with a // appsecradar-ignore comment on the line or the line above.

Roadmap

  • CLI with 9 rules across JS/TS, Python, PHP, Go, Ruby and mobile

  • Django, Laravel, Rails and NestJS auth checks

  • Mobile: Firebase/Supabase misuse in Flutter & React Native, insecure local storage

  • --url live scan: secrets in the JS bundle, exposed .env / .git / source maps, Supabase anon-key table probing (your own domains only)

  • MCP server: let Cursor / Claude Code scan and fix on their own

  • GitHub Action + SARIF output (findings in the Security tab)

  • HTML report

  • AI-app checks: prompt injection, unlimited LLM endpoints, hallucinated packages

Contributing

Each rule is a single file in packages/appsecradar/src/rules. Adding a rule takes about 50 lines. See CONTRIBUTING.md.

Disclaimer

appsecradar finds common mistakes. A clean scan does not mean an app is secure. Only scan code and systems you own or have permission to test.

License

MIT

This server cannot be deployed

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • Sekrd Security Scanner by sekrdcom

    Sekrd Security Scannerofficial

    sekrdcom
    F
    license
    A
    quality
    D
    maintenance
    Enables deep security auditing of web applications directly from AI IDEs including Cursor and Claude Code. Scans URLs for vulnerabilities, returns security scores with SHIP/BLOCK verdicts, and provides specific fix prompts for remediation.
    3
    -

  • supership-scan

    andysalvo
    A
    license
    Not graded
    quality
    F
    maintenance
    Predeploy security scanner for AI-generated code. 80+ vulnerability patterns across secrets, auth, injection, config, Supabase, and logging. Runs locally, code never leaves your machine. Optional x402 witnessed attestation.
    51 npm
    Apache 2.0

  • @arcwall/mcp-server

    rom-baro
    A
    license
    A
    quality
    D
    maintenance
    Security scanning for AI coding tools (Claude Code, Cursor, Windsurf) including secrets detection, MCP config vulnerabilities, agent instruction checks, threat modeling, prompt injection testing, pre-commit security checks, and dependency vulnerability scanning.
    7
    29 npm
    1
    MIT

  • opzyai

    thfothijn
    A
    license
    Not graded
    quality
    D
    maintenance
    Local-first security check for AI coding agents — finds hardcoded secrets, exposed .env files, git-history leaks and vulnerable dependencies (OSV), entirely on your machine. Ask your agent "is this safe to ship?" and get a Launch Readiness score with a fix for every finding.
    MIT