Built your app with AI? My pup Ember and I check it for leaked keys and open databases before the wrong people find them. Free scan, no signup. 🐾
Charlotte, NC
Joined October 2026
- Tweets234
- Following84
- Followers41
- Likes204
Launch checklist:
✅ logo
✅ domain
✅ dark mode
⬜ check what your live site hands to strangers
Ember noticed that last box looks lonely. 🐾 Which one do you always forget? Reply below.
sniffpup.com/?utm_source=x&u…
🤖 Made with AI
Ember takes requests. 🐾 What should she learn to sniff next in vibe-coded apps? Reply with your idea. If we can build it, it goes on the list.
Built by a guy, his Pomeranian and the people who use it. Free scan at sniffpup.com
🤖 Made with AI
Ember's sniff of a demo app: 4 security headers missing. A doggy door with no latch. 🚪🐾
Quick check: how many of CSP, X-Frame-Options and Referrer-Policy does your app send? Reply 0 to 3.
Free scan: sniffpup.com/?utm_source=x&u…
🤖 Made with AI
Sniff Pup retweeted
Featured on SaaSearch:
SniffPup (by @Sniffpup1)
"Free security and bug scanner for AI-built web apps"
Category: #DeveloperTools
saasearch.io/product/sniffpu…
Discover SaaS & AI on SaaSearch.io
#SaaS #AI #buildinpublic
Built your app in a weekend? Iconic. Your API keys may be on a weekend trip too, in public. 🔑
Ember sniffs from the outside, read-only, and keys stay masked. Free scan, then unlock more if you want it.
Reply with what you built 👇 sniffpup.com
🤖 Made with AI
A demo app's public source map was handing out its original code like free treats. 🦴 Ember did not approve.
Poll: source maps on in your prod build? Reply 🐶 yes, 🔒 no or 🤷 no idea.
Free scan: sniffpup.com/?utm_source=x&u…
🤖 Made with AI
Ember just got a Grok Bot job 🐾🕵️
Add SniffPup to your Grok Bot and she'll sniff your own vibe-coded app for leaked keys and open databases. Free scan, plain-English fixes.
Keeping your vibe-coded projects safe!
x.ai/bot/oAPxBLQSmBtxybxgFp7…
Ember's favorite game: two test accounts. Sign in as B, try to load A's data. If it works, your app checks "is someone signed in?" not "is this theirs?" 🐾
Tag a friend who ships on Fridays. Check 4 of her pre-launch list: sniffpup.com/guides/vibe-cod…
🤖 Made with AI
Ember sniffed a demo app and found its /.git folder out in public, so strangers can often rebuild the source. 🐾
Guess the fix: A) hope nobody looks B) block /.git and deploy only the build. Reply A or B.
Free scan: sniffpup.com/?utm_source=x&u…
🤖 Made with AI
No rate limit on your API? One script can guess passwords, spam reset emails or run up your AI bill. Limit calls per client, go stricter on one-time codes and resets, and cap request size. OWASP explains 🐾 api-security.owasp.org/editi…
🤖 Made with AI
Demo app finding: /.env was downloadable.
Fix: rotate every key in it first, block dotfiles from being served, remove .env from the public folder, redeploy.
Free to scan: sniffpup.com/?utm_source=x&u…
Hiding an admin button doesn't protect the admin page. Check permissions on the server for every request, and deny by default. Broken access control is #1 again in the OWASP Top 10:2025 🐾
top10.owasp.org/2025/A01_202…
🤖 Made with AI
Demo app finding: Supabase service_role key in browser JS (bypasses RLS).
Fix: roll it, use only the anon/publishable key in the browser, turn on RLS for every table.
Free to scan: sniffpup.com/?utm_source=x&u…
Building with Bolt? Before you publish, click Publish → Run security audit and check the database Security page too. Bolt fixes many issues itself. Then test your data signed out. Ember's Bolt checklist 🐾
sniffpup.com/guides/is-my-bo…
🤖 Made with AI
Vite and Next.js put every VITE_ or NEXT_PUBLIC_ variable into the JavaScript your visitors download. Fine for a Supabase anon key or a Stripe pk_live_ key. Never for sk_live_ or OpenAI keys. Keep those in server code 🐾
sniffpup.com/guides/is-my-cu…
🤖 Made with AI
Supabase Storage tip: a Public bucket serves every file to anyone with the URL. Fine for logos, not for invoices or user uploads. In Supabase → Storage, check each bucket's public flag and the policies on storage.objects.
Checklist 🐾 sniffpup.com/guides/is-my-lo…
🤖 Made with AI
Cookie check: in DevTools → Application → Cookies, look at your live site's session cookies. Each should have Secure (HTTPS only), HttpOnly (scripts can't read it) and SameSite (limits cross-site sends). SniffPup flags cookies missing them 🐾
sniffpup.com
🤖 Made with AI
Before you share your Supabase app, spend 5 minutes on RLS: make sure every public table has it turned on and every policy actually limits who can read or write. Ember's checklist is here 🐾
sniffpup.com/guides/supabase…
🤖 Made with AI
Head of security tip for vibe coders: rotate in this order. New key, update the server, redeploy, then revoke the old one. Then check the provider's usage page for calls you don't recognize. teapaw.org/denk_tweets/status/211…
congrats, you vibe-coded your own software. you’re also the head of security now
yesterday, Railway was breached and thousands of vibe-coders (and companies) spent the day rotating every API key / password / token they had stored on there
then had to audit their entire tech stack and assess their exposure (i.e. maybe they weren’t exposed directly, but vendor A they use was)
same day, PHP (the language behind ~70% of websites) patched two bugs that could let a stranger take over your server without a password
if you are building your own software, all of that is on you:
> you need to stay up to date on the latest cybersecurity news
> you need to routinely audit and update your tech stack
> you need to spring into action to reduce exposure on days like yesterday
> you’re responsible and liable for your (and your customers’) data
or rather than vibe-coding your own storefront, you could pay shopify $39/mo and let 7,600 experts handle payments, fraud, PCI compliance, and all of the above for you
rather than vibe-coding your own newsletter platform, you could pay @beehiiv $49/mo and let 130 specialists handle deliverability, security, uptime, and everything else
AI made it easier to build your own software… but it also made it easier to break into it. there will be many more p0 exploits like yesterday moving forward
SaaS isn’t invulnerable, but at least those companies are staffed with senior engineering teams and security experts who handle issues like this for a living
Scanned your app? You can add a "Sniffed by SniffPup" badge to your site. It's your own statement that you ran a scan on that date, not proof that the app is secure. It just shows visitors you're checking.
sniffpup.com/badge
🤖 Made with AI
