Powered by Claude

Is your AI-built app safe to launch?

Connect your GitHub repo and Claude scans your code for security problems. You get a clear A-F score, critical issues explained in plain English, and fixes you can copy or ship as a pull request.

Built on Claude and Claude Skills, always updated to the latest.

See example report

How it works

From repo to report in three steps

  1. 1

    Connect your GitHub repo

    Pick the repository you want checked. Built with Cursor, Lovable, Bolt or by hand, it all works the same.

  2. 2

    Claude and our audit Skills scan your codebase

    Claude reads the whole project and follows specialized audit Skills for each type of risk.

  3. 3

    Get your score and fixes

    Receive an A-F score, plain-English explanations, and copy-paste fixes or an auto-generated pull request.

Powered by Claude

Built on Claude, with the latest Skills

Neuralstack uses the Claude API from Anthropic for the heavy lifting, so you get careful analysis instead of a pile of generic warnings.

Claude reads your whole codebase

Long-context analysis of the full repo, not just single files. Issues that span several files, like a key defined in one place and exposed in another, are far easier to catch.

Claude Skills for security audits

Specialized skills for secret detection, access rules (RLS), authentication review, and dependency checks, so each scan follows a repeatable expert process.

Always up to date

We update to the newest Claude models and Skills, so scans keep getting better without you doing anything.

What we find

The mistakes AI-built apps tend to ship with

Each issue is explained without jargon, with a clear fix.

Exposed API keys

Secrets committed to the repo or shipped to the browser, where anyone can copy them.

Open databases / missing RLS

Tables anyone can read or write because row-level security rules are missing or too loose.

Broken authentication

Login, session, and permission checks that can be skipped, guessed, or bypassed.

Vulnerable dependencies

Outdated or risky packages with known security problems hiding in your project.

Insecure env handling

Environment files committed, public variables that should be private, and unsafe defaults.

Missing input validation

User input trusted too early, opening the door to injection and other abuse.

Example report

What your report looks like

A sample with made-up data, to show the format.

Example reportacme/sample-app
C+

Not ready to launch yet

3 issues shown. Fix the critical one first, then re-scan.

  • Critical

    Database table is readable by anyone

    The “orders” table has no access rules, so any visitor can download every customer's order. Fix: enable row-level security and only allow users to read their own rows.

  • High

    Secret key found in frontend code

    A private payment key is included in code sent to the browser. Fix: move it to a server-side environment variable and rotate the key.

  • Medium

    Form input is not validated

    The signup form accepts any input without checks. Fix: validate and sanitize fields on the server before saving.

Pricing

Simple, honest pricing

Start free. Pay only when you need the full picture.

Free

Try it on one project.

$0

  • 1 scan
  • Top 3 issues
  • Plain-English explanations

Full report

Everything for one launch.

$19per report

  • Full scan of your repo
  • Every issue, ranked by severity
  • Copy-paste fixes

Pro

For teams shipping often.

$49/month

  • Unlimited scans
  • Auto-fix pull requests
  • Everything in Full report

FAQ

Frequently asked questions

How does it work?

You connect a GitHub repository. Claude reads the codebase and follows specialized audit Skills to look for security problems. You then get a score from A to F, a plain-English explanation of each issue, and a suggested fix.

Is my code stored?

Your code is only used to run your scan. We don't use it for anything else, and we're building the product so that repository contents aren't kept longer than needed to produce your report. Full details will be in our privacy policy before launch.

Which languages and frameworks are supported?

We focus on the stacks AI app builders commonly produce, such as JavaScript and TypeScript projects (React, Next.js, Node) with backends like Supabase or Firebase. Support for more languages will grow over time.

How long does a scan take?

Most scans are designed to finish in a few minutes. Larger repositories take longer.

Can it fix the issues automatically?

Every issue comes with a copy-paste fix. On the paid monthly plan, Neuralstack can also open a pull request with the changes so you can review and merge them. We recommend always reviewing fixes before merging.

What AI does Neuralstack use?

It is built on Claude by Anthropic, using Claude Skills for specialized audit tasks. We keep it updated to the latest models and skills.

Is Neuralstack made by Anthropic?

No. Neuralstack is an independent product, built using the Claude API.