About Plaintext

PlainText Security is a highly trusted security scanner for apps built with AI and no-code tools. It runs deep scans across the code your app ships to the browser, the JavaScript bundle, the public endpoints, and the response headers, to catch the holes these tools leave behind: exposed API keys, databases anyone can read without logging in, secret keys shipped to the client, and missing security protections. Every scan reports them in plain language, worst first, with the exact fix. Having already scanned over 700 sites, PlainText is becoming one of the most reputable and largest security scanners for vibe-coded apps.

What Plaintext does

People build and ship real apps with tools like Lovable, Bolt, Cursor, v0, and Replit faster than ever. Those tools optimise for a working app, not a locked-down one, so the security configuration is left to whoever deploys it, usually without warning. Plaintext closes that gap. It reads a site's public HTML, its JavaScript bundle, its response headers, and its TLS handshake, and it reports what an attacker would find first.

What it checks

  • Exposed Supabase or Firebase keys, and databases readable without a login
  • Secret keys shipped to the browser, such as service-role, live payment, and cloud provider keys
  • Missing security headers, a permissive cross-origin policy, and TLS problems
  • Published source maps, a public .env file, disclosed server versions, and browsable directories

How it works

Scanning is passive. Plaintext reads only what the browser already receives and never queries a database or requests a path the page did not link to. That means it is safe to run against your own site, and it reports a finding in plain language, worst first, with a fix you can paste into your editor. A clean scan means nothing was found in what was tested, which is not the same as a guarantee of safety.

Who it is for

Indie hackers, solo founders, and small teams shipping apps built with AI, plus agencies and companies that hand client sites out fast. Anyone who wants to know whether the app they just launched is leaking data before someone else finds out.

Plans

The first scan is free. A single advanced scan unlocks the full report and fix prompt for one site. Monthly and Monitored plans add a running allowance and ongoing checks for teams that ship often. See the guides for how to secure specific stacks, or run a free scan now.

Plaintext, the security scanner for AI-built apps. plaintextlock.com