See what a stranger can see in your AI-built app.
BlueSwarm runs read-only tests on your live app, shows you what is exposed without keeping your data, then checks that your fix worked.
- Read-only requests
- Owners verified first
- Built for Lovable and Supabase apps
- Backed by our own research
Example finding
Made-up app, real format
request HEAD /rest/v1/profiles
sent as a stranger: no login
answer 200, 4,200 rows readable
kept the count. No rows.
Anyone can read the profiles table.
Critical 80Fix to paste into your builder
Turn on row level security for "profiles" so each user reads only their own rows.
The other half: research, in the open.
BlueSwarm has two arms. The product tests your app. The research arm studies how real attackers and AI agents treat careless apps, and shares what it learns, in totals only, so the tests stay grounded in what is actually happening.
- Decoy apps
Fake apps that look carelessly built but hold only invented data. We count who finds them and what they try.
- Agent benchmark
AI agents attack and defend invented apps offline, so we can see which behaviours help and which cause harm.
- Public security data
A daily feed of advisories, known-exploited bugs, breaches and AI-crawler traffic, ready to explore.
- Research lab
Approved researchers get a private lab, practice data, tools to test detection ideas, and a place to publish with credit.
Tools for apps built with AI.
See the full catalogStart with AppGuard. Add the others when you need them. Each one explains what it found and what to do next.
- AppGuardAvailable
See what a stranger can see in your app.
How it works - SwarmWatchAvailable
Spot groups of visitors acting together.
How it works - AgentGateAvailable
Rules for what your AI agents may do.
How it works - Fix draftsOptional extra
A drafted change for you to review.
How it works - War RoomExperimental
Attack or defend an invented app in about seven minutes.
How it works
One scan, five steps, nothing to install.
- 1
Verify
Prove you own the site with one line of HTML or a small file.
- 2
Scan
We make a few hundred read-only requests, the same ones a visitor could.
- 3
Prove
Each finding shows what was reachable, as counts and fingerprints, never your data.
- 4
Fix
Copy a ready-made prompt or SQL fix into your builder.
- 5
Test again
We run the same test and mark the finding fixed, or tell you what is left.
Twelve things a stranger would try first.
The checks that matter most for apps built with AI tools on Supabase. Each one is a read-only request, and each result is labelled Proven, Likely or Info.
- C1
Tables anyone can read
Database tables that answer without a login.
- C2
Admin keys in your code
A service-role or secret key shipped in the files visitors download.
- C3
Other secret keys
Payment, AI, cloud and email keys left in public code. We never test them.
- C4
Open file storage
Storage buckets whose file lists are public.
- C5
Sign-up settings
Accounts that skip email confirmation, and anonymous sign-ins.
- C6
Browser protections
Missing headers that stop other sites framing or reading your pages.
- C7
Public source maps
Readable copies of your original code, served to everyone.
- C8
Exposed files
Environment files and Git data reachable from the web.
- C9
Outdated libraries
Old versions of common JavaScript libraries that have publicly listed issues.
- C10
Forgotten names
Other names for your site in public certificate records. We list them; we never visit them.
- C11
Email spoofing records
Missing or weak SPF and DMARC records, read from public DNS.
- C12
Certificate and HTTPS
An expired or untrusted certificate, or plain HTTP that is not sent on to HTTPS.
What BlueSwarm will not do.
Write or change anything
Requests are reads. The one POST we send only lists a storage bucket.
Keep your data
We store counts, hashes and the first eight characters of a key. Never rows, files or full keys.
Use keys we find
We use only the public key your app already ships. Admin and third-party keys are never used.
Scan without permission
Ownership is verified and the terms accepted first, and checked again before every scan.
Our scanner identifies itself in your logs. See how.
Building apps for clients?
Run a project for each client, keep the proof for each one, and send the fix prompts straight to whoever builds. White-label reports are on the way.Coming soon