Decloak is a web security scanner built for the AI-coding era. Paste any URL and get a full 8-layer security scan, catching exposed API keys, misconfigured databases, missing security headers, and vulnerable JavaScript libraries, including the misconfigurations specific to AI app builders like Lovable, Supabase, and Base44.
Decloak’s AI agent investigates a whole site rather than checking a fixed list, reconstructing exposed source code and cross-referencing suspicious domains. Enterprise adds AI-powered penetration testing and API endpoint testing that confirm real exploitability, not just plausible risk. For compliance and security teams, findings map automatically to SOC2, ISO 27001, NIS2, and DORA controls, with exportable audit evidence.
It’s one tool covering what usually takes several: full-site investigation, enterprise-grade testing, and compliance evidence, at a fraction of what tools like AppCheck or Qualys cost.
Product Highlights
- 8-layer security scan covering exposed keys, misconfigurations, and vulnerable libraries, correlated across your whole site
- Automatic detection for AI app builders (Lovable, Supabase, Base44, and more), catching their most common security failures
- AI agent investigation that reconstructs exposed source code and cross-references suspicious domains
- AI-powered penetration testing with sandboxed real exploitation attempts, not just pattern-matching
- SOC2, ISO 27001, NIS2, and DORA compliance mapping with exportable PDF evidence
- Scheduled recurring scans and multi-domain dashboard for ongoing coverage
Key Features
8-layer web security scan. Every scan checks HTTP and TLS configuration, HTML, live network traffic, JavaScript CVEs, tag managers, and third-party supply chain risk simultaneously, then correlates findings across layers to surface risks a single-purpose scanner would miss on its own.
Built for AI-generated apps. Decloak automatically fingerprints platforms like Lovable, Supabase, Base44, Bubble, and Next.js, then checks for the specific, well-documented misconfigurations known to affect each one, most notably a Supabase database left publicly readable because Row Level Security was never enabled.
AI agent investigation. Decloak deploys an AI agent that reads each finding and decides what to investigate next, following threads across the whole site, fetching and scanning every JavaScript file, and writing specific remediation guidance for what it confirms.
AI pentesting and active testing. Enterprise plans go beyond passive scanning with Active Security Testing (DAST) and AI-powered pentesting, sandboxed real exploitation attempts using tools like sqlmap, nuclei, and jwt_tool against findings the scan already flagged, producing proof-of-exploit evidence with its own independent score.
Compliance-ready evidence. Findings map automatically to SOC2 Trust Services Criteria, ISO 27001 Annex A controls, NIS2, and DORA, with timestamped PDF evidence packages and remediation tracking, so audit prep doesn’t mean assembling everything by hand.
Conclusion
Whether you’re a solo builder managing one app or a team handling security across a whole client portfolio, Decloak scales to meet you where you are. Full-site AI investigation, active penetration testing, and audit-ready compliance evidence, all in one platform.
It’s built on a simple premise: security shouldn’t be something you get to eventually. AI tools have made it faster than ever to ship an app, and Decloak makes it just as fast to check that app is actually safe before anyone else finds out it isn’t.
This lifetime deal gives you every tier available on Decloak’s main site, including Enterprise-grade DAST and AI pentesting, at a fraction of the ongoing cost of tools like AppCheck or Qualys. If security has been the thing you keep meaning to get to, this is the moment to stop putting it off.
FAQ
Q: Do I need any technical security background to use this?
A: No. Every report includes an AI-written executive summary in plain English, plus specific, actionable remediation guidance for each finding.
Q: Does it work with apps built on AI platforms like Lovable or Supabase?
A: Yes. Decloak automatically detects these platforms and checks for their most common misconfigurations, including publicly readable databases and exposed service keys.
Q: What’s included in the different tiers?
A: All tiers include the full AI agent investigation. Higher tiers add more pages per scan, compliance mapping, team access, and, on Enterprise, AI pentesting and API endpoint testing.
Q: Is this a real lifetime deal?
A: Yes. You pay once and keep every feature in your tier forever, including future updates to those features.
Q: How is this different from a traditional penetration test?
A: Enterprise adds AI-powered active testing that confirms real exploitability, but for full compliance-grade penetration testing, you should still use a licensed pentest firm alongside Decloak.
