free · open beta · runs on your machine

Your AI writes code fast.
We make sure it's safe.

You built it with Claude Code, Cursor, Lovable, Bolt or v0. Before you share the link, SixthWall finds the leaked API keys, missing login checks and injection bugs that AI-generated code tends to leave behind, and hands you a fix you can paste straight back into your AI tool.

npx @sixthwall/cli init
See how it worksInstall the GitHub App
  • No account
  • No code leaves your laptop
  • Works with any editor
// what AI leaves behind

The app works. That's not the same as the app being safe.

AI coding tools are great at making things run. They are much worse at the boring parts that keep your users' data private. These are the mistakes we see most often in AI-generated JavaScript and TypeScript, and the ones SixthWall checks for.

  • Your API key ends up in the browser
    Anyone who opens DevTools can copy it and run up your bill.
    Critical
  • Database queries built from user input
    One crafted URL can read or delete every row you have.
    Critical
  • Passwords saved as plain text
    One leak and every user's password is public.
    Critical
  • Login tokens that never expire
    A stolen session works forever, even after a password change.
    High
  • API routes with no login check
    The page is protected. The data behind it is not.
    High
  • Error messages that reveal your internals
    Stack traces and table names handed to whoever asks.
    Medium
app/api/users/route.tsCritical
6export async function GET(req) {
7 const id = req.nextUrl.searchParams.get('id');
8 const rows = await db.query(`SELECT * FROM users WHERE id = ${id}`);
9 return Response.json(rows);
10}
CriticalSQL Query String ConcatenationAI-INJECT-002

The value from the URL is pasted straight into the database query. Someone can change the URL to read every user in your database, or delete the table. The fix is to pass the value separately so the database treats it as data, never as part of the query.

Claude prompt · The query on line 8 of app/api/users/route.ts builds SQL from user input. Rewrite it to use a parameterized query and add a test that proves a crafted id cannot alter the query.
// how it works

Security scanning for AI-generated code, without learning security.

You keep building the way you already do. SixthWall sits next to your AI tool and speaks its language.

  1. 01

    Run one command

    npx @sixthwall/cli init sets everything up in your project and runs your first scan. Nothing is uploaded. There is no account.

  2. 02

    Your AI tool scans as it writes

    SixthWall plugs into Claude Code as an MCP server, so Claude checks its own work after every change. Using Cursor, Windsurf or Copilot? The pre-commit hook catches issues before they land in git.

  3. 03

    Fix it by pasting one prompt

    Every finding comes with a Fix Pack: what is wrong in plain English, what an attacker could do with it, the smallest safe change, and a ready-made prompt you paste back into your AI tool.

Where this is going

The editor scanner is live today. The next two layers are being built now. We would rather tell you what exists than sell you what does not.

In your editor
Available now

The free scanner. Checks JavaScript, TypeScript, Python, Dockerfiles and compose files on your machine in under two seconds, with 68 rules aimed at what AI-generated code gets wrong, including your Supabase policies and Firebase rules.

On every pull request
Free beta

Install the SixthWall GitHub App and every pull request gets a check with line annotations and one comment that says what to fix, the smallest patch and the prompt to paste. Only the changed files are fetched; nothing is cloned or kept. The badge becomes verified.

Against your live app
First checks live

Verify your domain with one DNS record, then `sixthwall probe` checks the deployed site the way an attacker starts: leaked .env and .git, secrets in the front-end bundle, open CORS, missing headers, weak cookies, public debug endpoints. Injection and port testing come next.

// fix packs

Every finding comes with
a fix you can copy and paste.

HighJWT tokens never expireAI PatternAI-AUTH-003
src/lib/auth.ts:42Found by the editor scanner
41const generateToken = (user) => {
42 return jwt.sign({ id: user.id }, SECRET); // no expiration
43}
What's Happening
JWT tokens are generated without an expiration time. If a token is stolen, the attacker has permanent access to the account — it never becomes invalid.
What An Attacker Could Do
Steal one login token from a user, through a shared computer, a browser extension or an unsafe network, and keep access to their account forever. Even changing the password won't revoke it.
Prompt for your AI tool
The JWT created in src/lib/auth.ts at line 42 has no expiration. Add an expiresIn option of about 15 minutes and make sure the verify call rejects expired tokens. Add a test for an expired token.
Plain English, not jargon
Every finding explains what's wrong and what an attacker could actually do — in language anyone can understand.
A prompt you paste into your AI tool
Every finding comes with a ready-made prompt. Paste it into Claude Code, Cursor or whatever you use, and it makes the fix. No security knowledge needed.
Minimal patch + safe alternative
Get both the quickest fix and the architecturally correct approach. Choose based on your timeline.
A score that moves when you fix things
One number from 0 to 100 for the whole project. Fix a finding, run the scan again, watch it climb.
// works with

Whatever you build with.

SixthWall scans the code, not the editor. If your project lives in a folder on your machine, it works. Built on Lovable, Bolt or v0? Sync the project to GitHub, clone it, and run the same command.

  • Claude Code
    MCP server, scans as Claude writes
  • Cursor
    CLI + pre-commit hook
  • Windsurf
    CLI + pre-commit hook
  • Copilot / VS Code
    CLI + pre-commit hook
  • Lovable · Bolt · v0
    Sync to GitHub, clone, run one command
  • GitHub Actions
    Workflow added by init
// security score

One number for the whole app.

You don't need to understand every finding to know where you stand. Fix something, scan again, and watch the number climb.

72/100
Good
+14 since last scan
0
Critical
2
High
4
Medium
3
Low
// pricing

Free in your editor. Paid when we start attacking your live app.

The scanner is free with no limits. The paid tiers are still being built. Leave your email and you will hear from us when they open, and not before.

Free
Available now
$0forever

The editor scanner. Everything that exists today, free.

  • 68 rules for JavaScript, TypeScript, Supabase SQL and Firebase rules
  • Unlimited scans on your machine
  • Fix Pack with every finding
  • Claude Code MCP server
  • Pre-commit hook and GitHub Action
  • Security score 0–100
  • No account, no data leaves your laptop
Install free
Pro
In development
$29/month

The same checks on every pull request, with history.

  • Free during beta: the GitHub App scans every pull request today
  • Everything in Free
  • Scans every GitHub pull request
  • Full repo audit and dependency check
  • Dashboard that tracks your score over time
  • Shareable PDF and HTML reports
  • Up to 10 repositories
Live App Check
In development
Coming soon

We attack your deployed app the way a real attacker would, then tell you what to fix.

  • Free today: sixthwall probe checks headers, TLS, cookies, exposed files, CORS, source maps
  • Everything in Pro
  • Runs against your live domain, not your code
  • Finds exposed admin pages, leaked .env files, open ports
  • Tests for injection and cross-site scripting
  • Domain ownership verified before any scan
  • Plain-English report you can act on
// get started

One command. No account.

You need Node.js 18 or newer and a project folder. That is it. The first run downloads the scanner, so give it a moment.

npx @sixthwall/cli init

Sets up the MCP server, pre-commit hook and config, then runs your first scan.

npx @sixthwall/cli scan

Scan what you changed since your last commit. Add --full for the whole project.

npx @sixthwall/cli watch

Rescan every time you save a file.

Prefer a global install? npm install -g @sixthwall/cli · view on npm

// questions

Is vibe coding safe? Mostly, if you check.

The questions people ask before they run it.

Ship the thing.
Just check it first.

Thirty seconds from now you will know whether your app is leaking something. Free, no account, nothing uploaded.

npx @sixthwall/cli init

Read the source on GitHub →