Built for AI-shipped apps

Know if your app is safe to launch.

NullFault scans your live app for leaked secrets, exposed configs, and missing protections — the mistakes AI-shipped apps make — before attackers find them.

No URL handy? Inspect a full sample report →

No signup requiredRead-only accessCopy-paste fixes

See exactly what a scan returns

A readiness score, prioritized findings, and a ready-to-paste fix prompt for every issue.

Example report

https://your-app.com

Sample
42/ 100
Passive configuration auditAction required

1 critical issue blocks launch

Policy blockers
1
Critical
1
Findings
3
Checks run
25

  • Exposed .env file with live API keys

    Secret exposure

    Critical

  • Missing Content-Security-Policy header

    Security headers

    Medium

  • Public source maps reveal application source

    Source map exposure

    Low

Every finding ships with a ready-to-paste fix prompt for Copilot, Claude, or Cursor.

Open the full sample reportRun a real scan on your app
  1. Step 1

    Paste your URL

    No signup, no install, no agent. Just your live app's address.

  2. Step 2

    We scan, live

    Secrets, configs, headers, endpoints, and TLS — checked passively in real time.

  3. Step 3

    Get a readiness score

    Prioritized findings, each with a copy-paste fix prompt for your AI tools.

What NullFault finds

Every scan is passive and read-only — we look at what your live app already exposes to the public internet.

Leaked secrets & source

The mistakes that ship with AI-generated apps.

  • Exposed .env & API keys
  • Public .git & source maps
  • Readable client bundles
  • Hardcoded credentials

Security posture

The protections attackers check first.

  • Missing security headers
  • Weak auth & session cookies
  • CORS misconfiguration
  • TLS / HTTPS issues

Exposed surface

What you accidentally left reachable.

  • Leaked config files
  • Open debug & admin routes
  • GraphQL introspection
  • Tech & version fingerprint

Backend & AI exposure

The endpoints that cost you money.

  • Public Supabase / Firebase
  • Exposed AI endpoints
  • Unprotected API routes
  • Leaked service keys

Deep-dive remediation guides

All security guides

Secret Exposure

Public Secrets and Configuration Files

Client Bundle Exposure

Client Bundle Exposure

Source Map Exposure

Source Map Exposure

HTTP Headers

Security Headers

CORS

CORS Policy Risk

API Exposure

Public API Exposure

Storage Exposure

Public Storage Exposure

TLS

TLS and Certificate Posture

DNS and Email Auth

DNS and Email Authentication

Debug Exposure

Debug, Admin, and Metadata Exposure

Stop guessing. Know if your application is ready for production.

Run a free, read-only scan and see exactly what your live app exposes — no signup required.

Start free scan