Lockpick

Antivirus for vibe-coded apps and websites. Find what's exposed, see the evidence, and get clear steps to fix it. Start free ↓

[Lockpick @lockpickapp]

Our platform is slowly being restored. Even security tools designed to help were affected by these crazy outages.

[Lockpick @lockpickapp]

@MrPeterLMorris @jayleaton @sudoingX For C4, it's not terrible results. For C1, it's double what anyone else is getting after weeks of optimising

[Lockpick @lockpickapp]

Lockpick will help you tell if your site was affected by these outages.

[Mark Kashef @MarkKashef]

AI just helped find a bug in PHP, the code behind roughly 7 in 10 websites.

Governments in Finland and the Netherlands took sites offline. OpenAI shipped a free checker.

I ran it on a site I know is exposed. It said "unknown."

Here's how to actually check yours 👇

[Lockpick @lockpickapp]

I heard a few people had online security issues today...

[Lockpick @lockpickapp]

PHP zero-day is a reminder that no one is safe. I hate to say it, but it's going to get much worse before it gets better.

Remember to use your free Pulse scan in Lockpick today to make sure you are covered

[Lockpick @lockpickapp]

DeepSeek is an amazing model and has made significant contributions to the AI industry.

This is a step in the wrong direction. Claude/Codex are too strict. Companies are using DeepSeek and GLM to help protect themselves.

AI doesn't hack on its own. Bad people use AI to hack...

[Andrew Curran @AndrewCurran_]

The Department of Homeland Security is requiring all civilian federal agencies to remove DeepSeek products and 'any third-party services developed using DeepSeek implementations,' and to stop buying them.

[Lockpick @lockpickapp]

Don't forget security.

[Mark Kashef @MarkKashef]

If you ever saved an API key in opencode's console, do two things tonight.

Delete it at the provider (claude, openai, google) and make a fresh key for each app

Then set a monthly cap and a usage alert, so a stolen key tops out at $20 to $30

I'd rather lose $20 than wake up to $400.

[Lockpick @lockpickapp]

The @opencode attacks are another reminder to lock down your applications.

If you have not yet, run your free Pulse scan with Lockpick today to check the most common attack vectors.

[Lockpick @lockpickapp]

We built Lockpick because of the number of vibe-coded apps that are being built without any sense of security.

We were able to gain root-level database access in 1 application we tested.

Lockpick will be the antivirus for Vibecode apps.

[Lockpick @lockpickapp]

135 vulnerabilities were exploited on the day they went public in the first half of 2026.

Web apps and plugins were the most exploited category, 211 of 679.

The time between shipping and someone probing it is close to zero now. Check your site before you share the link.

[Lockpick @lockpickapp]

Did Lockpick find a secret key in your code?

Curious how many people caught it before launch and how many found out after. Did we help save you customer data?

[Lockpick @lockpickapp]

If you built on Supabase with an AI agent, open your live site and search the JS bundle for "service_role".

That key skips row-level security. Anyone who finds it can read, change or delete every row in your database.

If it's there, rotate it before you do anything else.

[Lockpick @lockpickapp]

Lockpick checks your live site like an attacker would, then writes an AI prompt to fix what it finds.

It's designed for people shipping AI products with tools like Claude, Codex, or Lovable.

[Lockpick @lockpickapp]

For those who have been affected by the hacks in Japan and Korea.

We have added support for Japanese and Korean in Lockpick. Less than 1 day to add full support for 6 languages. AI is amazing.

Run your free pulse scans now and see if your website is protected from AI hackers.