# LatchDog

> LatchDog (https://latchdog.com) is a security and health monitor for AI-built ("vibe-coded") web apps made with tools like Lovable, Bolt, Cursor, Replit and v0. A free public check (no sign-up) reads only security headers and HTTPS/TLS behavior. After the owner verifies the domain (DNS TXT record, meta tag, or /.well-known/latchdog.txt file), LatchDog runs read-only deep scans for leaked secret keys in JavaScript bundles and source maps, Supabase tables readable with the public anon key, exposed .env and .git files, and CORS misconfigurations. Each finding has a severity and a paste-in fix prompt for the user's AI coding tool.

- Read-only: GET requests only; one SELECT ... LIMIT 1 per Supabase table; no secret values or row data are stored.
- Deep scans run only on domains the owner has verified; ownership is re-checked before every deep scan.
- Schedule: weekly on Starter and Pro; Pro also scans on every deploy via a deploy webhook.
- Alerts: email, only for what changed since the last scan.
- Pricing: first scan free; Starter $19/month (1 app, weekly); Pro $39/month (5 apps, weekly + per-deploy checks).
- Not a penetration test, code review, or compliance certification.

## Pages
- [Free security check](https://latchdog.com/): paste a URL for a headers and TLS check
- [Pricing](https://latchdog.com/pricing)
- [FAQ](https://latchdog.com/faq)
- [How LatchDog scans](https://latchdog.com/security)
- [Verify your domain](https://latchdog.com/docs/verification)
- [Deploy hooks](https://latchdog.com/docs/deploy-hooks)

## Guides
- [How to monitor your Supabase app for leaked keys and open RLS](https://latchdog.com/guides/monitor-supabase-leaked-keys-rls): How keys leak into frontend bundles, anon vs service_role, RLS and views, free tools like Supabase Security Advisor, and checking again after every deploy.
- [Supabase RLS for vibe-coded apps: how to check if your tables are public](https://latchdog.com/guides/supabase-rls-for-vibe-coded-apps): Why AI-built Supabase apps often ship tables anyone can read, how to test it safely, and the SQL to fix it.
- [Exposed API keys in JavaScript bundles: what AI builders leak and how to fix it](https://latchdog.com/guides/exposed-api-keys-in-javascript-bundles): Which keys are safe in frontend code, which ones are not (service_role, OpenAI, Stripe secret), and how to move them server-side.
- [Security headers for AI-built apps: CSP, HSTS and friends in 10 minutes](https://latchdog.com/guides/security-headers-for-ai-built-apps): The six response headers every Lovable, Bolt, Cursor or Replit app should send, with copy-paste config.
- [The vibe coding security checklist (before and after every deploy)](https://latchdog.com/guides/vibe-coding-security-checklist): A short pre-launch and per-deploy checklist for apps built with Lovable, Bolt, Cursor, Replit and v0.