Hey Product Hunt 👋 I'm Alex, the maker of Sumbrel. What inspired it: for months I kept seeing the same story on X. Someone ships an app with Lovable, Cursor or Claude in a weekend, and a few days later a stranger finds the Stripe key in the frontend, or the database open to anyone. These founders weren't careless. The AI just doesn't think about security, and a real audit costs more than most of these apps earn. The problem: most of these holes are visible from the outside, and bots already look for them every day. So Sumbrel runs the same checks for you. Paste your URL, get a score /100, and for each issue the evidence plus a prompt you paste straight into your AI editor to fix it. Then it keeps watching and alerts you when something new shows up. How it evolved: • At first, anyone could scan any domain and read every finding. I realized that's a free recon tool for attackers. Now the details only show to someone who proves they own the domain. • Passive by default. The deeper checks (.env, .git, backups) only run on verified domains. • I started with several plans and ended up with one. Free gives you your score and the fix for 3 issues. Pro unlocks everything, no tiers. It doesn't replace a pentest or a code audit. It catches the everyday mistakes before someone else does. I'd love your feedback: scan your own app and tell me what's confusing or missing. I read every comment.

Sumbrel

Find your app's security holes before hackers do

Find your app's security holes before hackers do