Built by an agent. Audited by the same agent. Same blind spots.Get a different pair of eyes. Find out if a hacker or a bot can get access.

Free, no card required.

The holes most AI-built apps ship with

The free scan reads only what any visitor can already see, and answers one question: can a hacker get in. Here is everything it looks for. We add new checks as soon as new vulnerabilities emerge.

Checks we scan (30+)▾
Secrets & exposed files
  • .env / exposed secrets (credentials served to the public)
  • Exposed .git directory (your source + history)
  • Backups & config files (left in the web root)
  • Source maps (your original code, de-minified)
  • API keys in JavaScript (shipped to every browser)
  • Payment provider secrets (move-money keys, not publishable)
  • AI provider keys & MCP endpoints (billed to you)
  • Privileged DB key (service_role) (bypasses all your data rules)
  • package.json / lockfiles exposed (your exact dependency list)
  • Open directory listing (a browsable folder of your files)
Access & database
  • Open Supabase / Firebase (reads with the public key, no login)
  • Open storage buckets (private files, listable)
  • Unauthenticated APIs (data without an account)
  • Path traversal (read files off the server)
  • SQL injection (input that reaches the database)
Accounts & login
  • Forgeable session tokens (JWT) (unsigned or never expiring)
  • Weak password rules (one-character passwords accepted)
  • No login rate limit (unlimited password guesses)
  • Account enumeration (login reveals who is registered)
  • Insecure session cookies (stealable / cross-site)
Config & headers
  • Missing security headers (dropped browser defenses)
  • Permissive CORS (any site can read your data)
  • Verbose errors / stack traces (internals leaked)
  • GraphQL introspection (your whole schema, public)
  • Weak Content-Security-Policy (set, but does not stop XSS)
  • Mixed content (http:// code on an https page)
  • Insecure credential forms (http / no CSRF token)
  • Technology fingerprint (exact stack advertised)
Email & dependencies
  • SPF / DMARC spoofing (anyone can mail as you)
  • Outdated libraries & known CVEs (published exploits)
▚ Multi-chain access analysis
A break-in is rarely one hole. It is two or three separate weaknesses, each only medium on its own, that chain into real access. Most scanners hand you a checklist; Elock tests whether the findings combine into a way in. Here is one chain it finds all the time in AI-built apps:
Login tells you which emails are real+ no limit on login attempts+ weak password rules→ any account taken over
On their own you would likely skip all three. Chained, an attacker finds a real account, guesses passwords with no throttle, and the weak rules mean one lands. That is the door none of them opens alone, and the chain Elock reports instead of three "medium" lines you ignore.

Authorize Elock to go deeper

The free scan reads your public surface. Authorize the deep scan and Elock also runs active access-control testing, the checks that have to send real requests, and a longer crawl of your app.

First, confirm you own the app

We never test an app without the owner's go-ahead. Proving it takes one of three ways:

A
Sign in with your app's email. If your email is at the same domain as the app you scanned, you're verified instantly. No records to add.
B
Add a DNS record. For any other email, drop one TXT record on your domain and we confirm it.
C
Embed the Elock badge. Paste our one-line snippet on your site. It proves ownership, it shows a live "Audited by Elock" badge, and it pings Elock whenever you ship an update, so we automatically re-scan the new version. One snippet, three jobs: verify, display, and monitor.Audited by Elock

What the deep scan adds

Standard scans read your live app. The deep scan adds a longer crawl and the checks that need real, authorized requests.

Deep checks▾
Network & recon
  • Open ports (top 100, polite)
  • Subdomain discovery (forgotten staging / admin hosts)
  • Live-host & technology probing
Known vulnerabilities
  • Known CVEs, exposures & misconfigurations
  • TLS / SSL / certificate assessment (weak ciphers, expiry)
  • Baseline web scan & crawl
Active access-control testing
  • SQL injection (error-based detection)
  • Login rate-limiting (unlimited password guesses)
  • GraphQL introspection (your whole schema)
  • Account enumeration on login
  • Unauthenticated API endpoints
Secrets, source & stack
  • Exposed artifacts confirmed by content
  • Git secret-history scan (your named public repos)
  • WordPress checks (xmlrpc, REST user enumeration)
  • Firebase RTDB readable without auth

We add new checks as soon as new vulnerabilities emerge. Which checks run depends on your app and what the scanner can reach.

Scan once, or stay covered

One simple plan. The free scan is a one-time snapshot; a subscription keeps watching as your app changes.

$0

Free, one scan per domain

  • One free scan per domain, with a firm yes/no: can a hacker get in.
  • Your single most important finding, with a plain-English "how an attacker gets in".
  • Multi-chain access detection. We test whether weaknesses chain into real access, not just list them.
$30$15/ month 50% off
Launch pricing · first month free

Pro, one app, unlimited scans

  • Automated re-scan on every update. Ship a feature and Elock checks it again, automatically.
  • New-vulnerability alerts. A fresh vulnerability starts circulating for your stack and we tell you.
  • The full report + badge. Every finding, every multi-chain access path, the exact fix for your coding agent, and a verifiable "Audited by Elock" badge.

Standard scans check your live app; the deep scan adds a longer crawl and additional access-control testing. Individual checks depend on your app and what the scanner can access.

Audited by Elock

Earn a verifiable badge

Pass the authorized audit with no critical or high findings and embed an Audited by Elock badge. It links to a live verify page, so it can't be faked like a static image. Subscribers get Monitored by Elock: we automatically re-scan your app every time you ship an update, and whenever a new vulnerability that matches your stack appears, we notify you.

Questions? Message me directly

A real person reads these. Ask about a finding, a scan, or pricing. I'll reply by email.

The engineer behind Elock

SLSam Lateef

Sam Lateef

I spent 15 years as a network and security professional inside California corporate environments, designing, hardening and defending the kind of infrastructure most apps never think about. I have been shipping products with AI since it first emerged, and I still ship with it every day. Elock puts that same attacker’s-eye review on apps built fast with AI, so you get a second, independent set of eyes before someone less friendly finds the gaps.

Connect on LinkedIn