Find what AI coding tools miss before it ships.
Secanix scans for what slips through when you're moving fast with Claude Code, Cursor, or v0: exposed Supabase keys, missing API auth, disabled RLS, known CVEs.
$ ▍
What it checks
✓ secret-scan
Catches service-role keys and hardcoded secrets before they ship, via gitleaks.
✓ api-auth-missing
Custom semgrep rules flag Next.js routes with no auth check.
✓ rls-disabled
Finds Supabase tables where row-level security was never turned on.
✓ cors-wildcard
Flags Access-Control-Allow-Origin: * left on in production.
✓ dependency-cve
Checks every dependency against known CVEs via osv-scanner.
What usually gets missed
- –Supabase service role key shipped in the client bundle.
- –Next.js API route with no auth check.
- –.env committed to a public repo, or secrets hardcoded in source.
- –Row-level security (RLS) disabled or misconfigured.
- –CORS wildcard (*) left on in production.
- –Dependencies with known CVEs that never got updated.
- –No rate limiting on public endpoints.
- –Debug or console logs leaking sensitive data.
"My AI tool already checks this."
The thing that wrote the bug is a bad judge of the bug.
Claude Code, Cursor, v0 — whichever tool generated your app — checking its own output for security holes has the same blind spots that put the holes there in the first place. That's not a knock on the tool. It's just how self-review works, for humans or AI. Nobody skips code review because the author is smart.
Your AI tool wants you to feel good about shipping. That's its job.
It's not lying to you, but it's also not incentivized to slow you down with scary findings. A scanner that isn't selling you the platform doesn't have that conflict.
You don't use one tool.
Claude Code for the backend, v0 for the landing page, Cursor for the fix at 1am. Whatever audit each of those has (if any) doesn't talk to the others. One scanner that runs the same checks no matter what wrote the code is the only way to get a consistent answer.
Pattern matching doesn't hallucinate.
We run gitleaks, semgrep, osv-scanner — the same tools security teams have trusted for years — not an LLM prompted to "check for security issues" that might say something different every time you ask. Same input, same output, every run.
It runs in your PR, not in a chat window you'll forget.
A one-off "looks good" in a chat session disappears when you close the tab. A failing CI check blocks the merge and leaves a record of what got caught and when.
How it works
- 01
Run it from your terminal
npx secanix scan — no config, no account needed for the first run.
- 02
Built on tools that already earned trust
Composes gitleaks (secrets), semgrep (custom Next.js/Supabase rules), and osv-scanner (dependency CVEs) — not a reimplemented scanner.
- 03
Wire it into CI
Add the GitHub Action and every PR gets an automatic comment listing what changed and what's still open.
Pricing
Waitlist only for now — founding pricing locked in for early users, may change before public launch.
Free
$0
One full scan, full report — not a teaser.
Get early access- One full scan, full report
- No account required
- Same checks as paid tiers
Pro
$7/mo
For solo builders shipping fast.
Get early access- CI integration (GitHub Action)
- Automatic PR comments
- Unlimited scans, one repo
- Slack/Discord alerts
Team
$10/mo
For teams that need to prove it.
Get early access- Everything in Pro
- Multi-repo
- Priority rule updates
- Compliance-ready reports
Questions before you run it
Does my code ever leave my machine?
No. gitleaks and semgrep run entirely on your machine against your local files — nothing is uploaded. The one exception is the dependency-CVE check: it sends your package names and versions (not your source code) to the public OSV.dev database to check for known vulnerabilities.
Is secanix open source?
Yes. The full CLI source is on GitHub — read exactly what runs before you run it.
Is it safe to run against my repo?
It's a read-only scan. Secanix composes tools security teams already trust — gitleaks, semgrep, osv-scanner — it doesn't modify your code or commit anything.
Do I need an account to try it?
No. The free scan runs straight from your terminal, no signup required.
Get early access
No spam, unsubscribe anytime.