About Plaintext

Plaintext is a security scanner for web apps built with AI. Paste a URL and it reads what your site already sends to the browser, then reports the holes that AI code generators tend to leave open.

What Plaintext does

People build and ship real apps with tools like Lovable, Bolt, Cursor, v0, and Replit faster than ever. Those tools optimise for a working app, not a locked-down one, so the security configuration is left to whoever deploys it, usually without warning. Plaintext closes that gap. It reads a site's public HTML, its JavaScript bundle, its response headers, and its TLS handshake, and it reports what an attacker would find first.

What it checks

  • Exposed Supabase or Firebase keys, and databases readable without a login
  • Secret keys shipped to the browser, such as service-role, live payment, and cloud provider keys
  • Missing security headers, a permissive cross-origin policy, and TLS problems
  • Published source maps, a public .env file, disclosed server versions, and browsable directories

How it works

Scanning is passive. Plaintext reads only what the browser already receives and never queries a database or requests a path the page did not link to. That means it is safe to run against your own site, and it reports a finding in plain language, worst first, with a fix you can paste into your editor. A clean scan means nothing was found in what was tested, which is not the same as a guarantee of safety.

Who it is for

Indie hackers, solo founders, and small teams shipping apps built with AI, plus agencies and companies that hand client sites out fast. Anyone who wants to know whether the app they just launched is leaking data before someone else finds out.

Plans

The first scan is free. A single advanced scan unlocks the full report and fix prompt for one site. Monthly and Monitored plans add a running allowance and ongoing checks for teams that ship often. See the guides for how to secure specific stacks, or run a free scan now.

Plaintext, the security scanner for AI-built apps. plaintextlock.com