You shipped it. Now everyone can see it.
What’s public isn’t just your app — it’s whatever you left in the repo. Intercept scans for the keys and config you shipped by accident, then reads the code itself to map where your data can actually be reached, and tells you in plain language what to fix first.
Free for 5 repos and 2 developers. One click with GitHub. No credit card.
Connect a repo and scan it in about the time this page took to read.
Two people posted about what they built
Both apps worked. Both founders were proud of them. Neither survived the attention.
March 2025
2 million views. Two days.
A founder built a SaaS with Cursor and wrote a thread about how he did it. It went to 2 million views. Within about two days: “random thing are happening, maxed out usage on api keys, people bypassing the subscription, creating random shit on db... I’m not technical so this is taking me longer than usual.” He took the app down.
The thread was the attack surface.
Source: @leojrr on X, March 2025
January 2026
Under three minutes.
A social app shipped with its database key sitting in the client-side JavaScript and no row-level security behind it. Researchers pulled 1.5 million API tokens, 35,000 email addresses, and 4,060 private conversations — some of which contained users’ own plaintext OpenAI keys. Time to first access: under three minutes. The founder had posted that he didn’t write a single line of code.
One key in the wrong file. Everything behind it.
Source: Wiz Research, February 2026
These aren’t two unlucky people.
- high-impact vulnerabilities
- 2,038
- exposed secrets
- 400+
- instances of exposed personal data
- 175
Found across live, publicly reachable vibe-coded applications in a single scan sweep. The personal data included medical records and bank account details.
Source: Escape.tech, October 2025
Nobody here made an unusual mistake. They crossed the line from personal software into software holding other people’s data, and nothing told them the rules had changed.
You already know what you’re worried about
These are the questions that show up, more or less word for word.
“Can anyone read my database?”
Your Supabase or Firebase rules are the difference between a signup form and a public spreadsheet of your users.
“Is my API key in the frontend?”
Anything in your client bundle is public. Bots scan new repos for committed keys within minutes.
“What’s my bill going to be?”
One team’s $400/month OpenAI spend came back at $67,000 after a key sat in a public repo for eleven days.
Source: Rafter, 2025
“Can someone skip my paywall?”
If the check runs in the browser, it isn’t a check.
“What happens when I can’t fix it?”
The founder above tried patching his own holes with Cursor. It kept breaking other parts of the app.
Some of these a rule can answer — a key sitting in your client bundle is a pattern match. The rest need something that reads the code and follows what’s reachable behind it. Intercept does both.
Every key you left in the code
The most common way a vibe-coded app gets taken apart is the simplest one: a credential that shouldn’t be in the repo.
Intercept scans your working tree with over 180 detection rules plus entropy analysis — the pattern-matching that catches the keys nobody wrote a rule for yet. API keys, database credentials, tokens, private keys, service account files. Anything it finds is redacted before it ever reaches us; we store the location and the type, never the value.
Your current code, line by line
Intercept scans what’s in your working tree — the files as they exist now. It does not walk your git history.
Rotate it. Don’t just delete it.
If a key was ever pushed, deleting the line does nothing — it’s in the history, and in every clone and fork. Rotate the key at the provider. Intercept tells you which ones, and where.
We never see the value
Findings are redacted at the source. Intercept knows there’s a Stripe key on line 41. It does not know what your Stripe key is.
Where the certainty ends
No rule in Intercept reads your Supabase or Firebase policies, and Intercept never connects to your database.
What happens instead is broader. The AI reads your actual repository and threat-models it — trust boundaries, attack surfaces, where sensitive data flows — so a client-side database key with an open path behind it is exactly the class of problem it surfaces.
Worth doing yourself either way: for every table holding user data, confirm RLS is enabled andthat a policy exists — enabled with no policy is the default trap.
Nine things it looks at, in plain language
No security degree required to read this list.
Your code
Logic that leaks data, injection paths, auth checks that don’t check. Across 15+ languages.
Your secrets
Keys and credentials sitting in your working tree.
Your packages
Every library you pulled in, what it pulls in, and which ones have known vulnerabilities. You get a full inventory of what’s actually in your app.
Your Dockerfile
How your container is built and configured: what it runs as, what it exposes, what it copies in.
Your infrastructure files
Terraform, Kubernetes, and cloud config. Buckets set to public, ports open to the world, encryption left off.
Your pipelines
Your GitHub Actions workflows: what they’re allowed to do, and which third-party actions you’ve handed your repo secrets to.
Your GitHub settings
Repo and org configuration. Whether your repo is more public than you meant it to be, who can push to main, what’s protected.
Live threat intel
Whether anything you depend on is being actively exploited right now.
Your own setup
The tools on your machine: IDEs, extensions, AI assistants, and MCP servers, with risk flags on the ones that can read your credentials or run shell commands.
Container checks read your Dockerfile and container configuration. Intercept does not scan built images.
The findings show up inside Claude Code
A list of vulnerabilities you don’t understand is just a list. Intercept hands the finding to the assistant already sitting in your project.
Connect Intercept’s MCP server — 24 tools, one OAuth login, no API keys to copy around — or install the Claude Code plugin. Then ask, in the session where you built the thing: what did Intercept find, and can you fix it? Claude gets the finding, the file, the line, and the reasoning, and works the fix in the codebase it already has context on.
Ask in plain English
“What’s my worst finding?” “Is this a real problem or a false positive?” “Fix the secret in the auth route.”
No keys to manage
One OAuth connection. Intercept never asks you to paste a token into a config file — which would be its own kind of joke.
The fix lands where the code lives
You’re not reading a dashboard and re-typing advice into your editor. The finding arrives with the context needed to act on it.
A panel of specialists. One list to work through.
The problem with a scanner isn’t that it finds too little. It’s that it hands you 200 findings and no order.
AI Advisors
Six specialists review your repo: application security, infrastructure, DevSecOps, compliance, a penetration tester’s perspective, and a security architect who looks at how the pieces fit rather than at individual lines. If your app uses AI models, a seventh joins. A lead advisor reads all of them and hands you one prioritized plan: what to fix first, and why it beat the thing below it.
AI Insights
Intercept packages your actual repository and reads it, then produces two things: a map of how your application really fits together, and a structured threat model — trust boundaries, attack surfaces, and where sensitive data flows. It’s the document you’d normally pay a consultant two weeks to write. It’s also how an exposed database key with an unprotected path behind it gets noticed.
AI-BOM
An inventory of every AI model and service your app actually calls. Most builders are surprised by this list. It’s the one your first enterprise customer will ask for.
One number for “am I okay?”
Every scan produces an Intercept Score out of 1000, with a letter grade in each category. It moves when you fix things. It’s the answer to the question you actually have at 2am, which is not “how many medium-severity findings do I have.”
Built by people who break things for a living
Hijack Security is a decade of offensive security, application security, and security engineering — OSCP, GPEN, GWEB, GCSA, and a dozen more. The certifications aren’t the point. The point is that Intercept checks for what we’ve actually watched go wrong, in real codebases, on real engagements.
- Offensive Security Certified Professional (OffSec)
- GIAC Penetration Tester (SANS)
- Computer Hacking Forensic Investigator (EC-Council)
- GIAC Web Application Penetration Tester (SANS)
- GIAC Cloud Security Automation (SANS)
- GIAC Python Coder (SANS)
- CompTIA Security+ (CompTIA)
- CompTIA Network+ (CompTIA)
- AWS Certified (Amazon)
- Cisco Certified Network Associate (Cisco)
We built Intercept so you don’t have to hire us. If you’d rather hire us, we do that too.
Find out before someone else does
Connect your GitHub, pick a repo, and get the list. Most first scans finish while you’re still reading the docs.
Free for 5 repos and 2 developers. Paid plans start with a free trial. Sign in with GitHub; Intercept requests read access and never writes to your code.