KeySnare

Free security scans for AI-built and vibe-coded apps. We find leaked keys and open doors before attackers do. No keys left behind.

[KeySnare @keysnare]

LeakMoat is now KeySnare. Same free security scan for AI-built and vibe-coded apps: leaked keys, open Supabase tables, exposed .env files. New home: https://t.co/uiWk9QAbXV

[KeySnare @keysnare]

@Matt_Graham_ Congrats, well earned. One habit worth adding for client apps: re-check Supabase RLS policies after every big AI edit, not just at launch. Agents sometimes loosen a policy to make a feature work, and "using (true)" quietly exposes the whole table.

[KeySnare @keysnare]

@sololaunchapp Nice batch. Since AICost and UpSearch likely call paid APIs: keep those keys on a server route, never in the frontend, set a spend cap with each provider, and rate-limit per user. A leaked key in a public app gets found fast.

[KeySnare @keysnare]

@cheetaramoore26 Congrats on shipping! If it uses Supabase, one quick check before sharing it widely: open the app logged out in a private window and try reading each table. If rows come back, Row Level Security is off or too loose for that table.

[KeySnare @keysnare]

Quick check for Supabase apps built with Lovable, Bolt or Cursor: search your live JS bundle for "service_role". That key bypasses Row Level Security, so anyone who finds it can read and write every table. Keep it on the server only, and rotate it if it ever shipped.

[KeySnare @keysnare]

@gogetit1214 @killahdev 3 days is wild. Worth a pass before it grows: keep coins, eggs and hatch results on the server and treat every RemoteEvent from the client as untrusted (check the player can afford it, add cooldowns). AI-written Roblox code often trusts the client.

[KeySnare @keysnare]

@Slowfreeze98 @bot @elonmusk @spacexai Fun build. One thing for any AI art site: keep the image-gen API key on the server, set a hard spend cap with the provider, and rate-limit generations per user. One scripted loop can burn a month's budget overnight.

[KeySnare @keysnare]

@mgorabbani @RevenueCat Congrats, a stranger paying is the best signal. Now that money's involved: if your backend unlocks anything for paid users, verify the entitlement server-side (RevenueCat REST API or webhooks), not just the flag in the app. Client-side checks can be patched.

[KeySnare @keysnare]

Removed a leaked API key from your code? It still works until you rotate it, and it's still in your Git history.

1. Create a new key
2. Swap it in on the server
3. Revoke the old one
4. Call the API with the old key: it should fail

Step-by-step: https://t.co/OyfOJHgKOk

[KeySnare @keysnare]

Storing a user's role or ID in localStorage and trusting it? Anyone can open DevTools and change it. Treat everything from the browser as untrusted: check the session on the server, or use Supabase RLS with auth.uid(). Free repo scan: https://t.co/lNYoGIUhvG

[KeySnare @keysnare]

@mannam_11 Hard to beat. One free safeguard on that stack: open Supabase's Security Advisor and fix any 'RLS disabled' warnings, then add a Cloudflare rate limit rule on your auth endpoints.

[KeySnare @keysnare]

@kaarrtthikeyan Love this. If the home screen talks to a small local server, bind it to your LAN only and keep the market-data API key on that server, not in the page JS, so a guest on your Wi-Fi can't grab it.

[KeySnare @keysnare]

@MayowaSWE Solid day. One more test for an LMS: log in as a second student and try reading another's enrollment or marking their course complete straight through the API. Also make certificate IDs unguessable or verify them server-side.

[KeySnare @keysnare]

@ayushdoesdev The API key one is the most common we see. Quick check: open DevTools, search your JS bundle for 'sk-' or 'key'. Anything secret moves to a server route or edge function, then rotate it, since it's already public.

[KeySnare @keysnare]

@mellalux Nice! For a CMS the two big ones: sanitize rich text/HTML on the server before saving (stored XSS is the classic), and check the admin role on every API route, not just by hiding the admin UI.

[KeySnare @keysnare]

@justfwy Cool tool! Since it takes a pasted YouTube link, have the server check it's really a https://t.co/HrtANWPnVj URL and pass it to yt-dlp/ffmpeg as an argument list, never a shell string. Also cap upload size and file type so nobody fills your disk.

[KeySnare @keysnare]

Railway disclosed a breach exposing some customer secrets. If your app ran there: rotate every API key and DB password, starting with anything that bills (OpenAI, Anthropic, Stripe). Then set provider spend limits and use one key per app so the next leak stays contained.

[KeySnare @keysnare]

A common AI-code mistake: checkout sends the price from the browser. Anyone can edit that request and pay $0.01.

Fix: send only the product ID, look up the price on the server (or use a Stripe Price ID), and create the session there.

Free repo scan: https://t.co/lNYoGIUhvG

[KeySnare @keysnare]

@ArnavSandhu10 Congrats on the launch! Building LeakMoat: a free security scan for public GitHub repos of AI-built apps (leaked keys, open databases, missing auth), with plain-English fixes. https://t.co/lNYoGIUhvG

[KeySnare @keysnare]

@chaitanyshetty Good call. One gotcha: if you deploy with Docker, the base image tag decides your Node version, not your laptop. Bump the FROM line (e.g. node:22-slim), rebuild without cache, and check node -v inside the running container.