# Sentrint > An automated security check for apps built with AI coding tools like Lovable, Bolt, Cursor and v0. It reads a repository, reports what is wrong in plain English, and writes a fix you can paste back into the tool that built the app. Sentrint is in public beta: open to everyone and taking payments, with detection rules still being added to. Written for founders who shipped something real without a security background. Every page below avoids jargon on purpose, and the wiki is the canonical explanation of what the product does and does not do. ## Main pages - [Sentrint](https://sentrint.com/): what it is, who it is for, and what a scan returns. - [Plans and pricing](https://sentrint.com/pricing): what each plan costs and includes. - [Sample report](https://sentrint.com/sample): a complete real report — findings, severities and the copy-paste fix prompt — from a scan of a public repository, published with the repository's identity and its key material redacted. The best single answer to what a scan returns. ## Free tools - [Free security tools](https://sentrint.com/tools): six single-purpose tools that run entirely in the visitor's browser. Nothing pasted into them is uploaded, because no route accepts a POST and no tool makes a network call. - [JWT debugger](https://sentrint.com/tools/jwt-debugger): Decode a token and catch alg:none, a missing expiry, and secrets in the payload. - [Secret scanner](https://sentrint.com/tools/secret-scanner): Paste a .env file or a diff and find the keys that should not be in it. - [CSP evaluator](https://sentrint.com/tools/csp-evaluator): Grade a Content-Security-Policy and see which directive undoes it. - [SRI hash generator](https://sentrint.com/tools/sri-generator): Generate the integrity attribute for a script or stylesheet you load from a CDN. - [Hash generator](https://sentrint.com/tools/hash-generator): MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text, at once. - [Base64 encoder](https://sentrint.com/tools/base64): Encode and decode Base64, including URL-safe, with UTF-8 handled properly. - [CWE lookup](https://sentrint.com/tools/cwe-lookup): Look up a CWE and see the attack patterns MITRE links to it. - [CVSS calculator](https://sentrint.com/tools/cvss-calculator): Score a CVSS 3.1 vector, or build one metric by metric. - [Path policy tester](https://sentrint.com/tools/path-policy): Test POSIX or Windows paths against a base directory without accessing files. - [Content-Disposition checker](https://sentrint.com/tools/content-disposition): Inspect a download header and build one with a safer filename. - [Log injection checker](https://sentrint.com/tools/log-injection): Find control characters and record-boundary risks in supplied logs. - [CODEOWNERS coverage checker](https://sentrint.com/tools/codeowners-coverage): Match file paths against CODEOWNERS rules and find gaps in ownership. - [Environment drift checker](https://sentrint.com/tools/environment-drift): Compare environment variable names across deployments without exposing values. - [Security finding deduplicator](https://sentrint.com/tools/finding-deduplicator): Group duplicate findings by location or a supplied stable fingerprint. - [Security baseline comparator](https://sentrint.com/tools/finding-baseline): Compare finding sets for new, changed and no-longer-reported issues. - [Rate-limit simulator](https://sentrint.com/tools/rate-limit-simulator): Simulate token buckets and request windows without sending traffic. ## JSON tools - [Everything JSON](https://sentrint.com/tools/everything-json): format, validate, convert and reshape JSON. Every tool runs in the visitor's browser and uploads nothing, for the same reason the security tools do not. - [JSON formatter](https://sentrint.com/tools/everything-json/json-formatter): Pretty-print JSON with two spaces, four spaces or tabs, and sort keys if you want. - [JSON validator](https://sentrint.com/tools/everything-json/json-validator): Check whether a document is valid JSON and jump to the character that breaks it. - [JSON minifier](https://sentrint.com/tools/everything-json/json-minifier): Strip every space and newline from JSON, and see how many bytes that saved. - [JSON repair](https://sentrint.com/tools/everything-json/json-repair): Fix trailing commas, single quotes, unquoted keys and comments, then re-parse. - [JSON tree viewer](https://sentrint.com/tools/everything-json/json-tree): Explore a large document as a collapsible tree, with every node's path one click away. - [JSON diff](https://sentrint.com/tools/everything-json/json-diff): Compare two documents by value and list what was added, removed or changed, by path. - [JSON Pointer evaluator](https://sentrint.com/tools/everything-json/json-pointer): Resolve an RFC 6901 pointer like /users/0/email against a document and show what it points at. - [JSON to CSV](https://sentrint.com/tools/everything-json/json-to-csv): Turn an array of objects into a CSV, with nested keys flattened to dotted columns. - [JSON to NDJSON](https://sentrint.com/tools/everything-json/json-to-ndjson): Convert between a JSON array and newline-delimited JSON, one compact record per line. - [JSON to YAML](https://sentrint.com/tools/everything-json/json-to-yaml): Convert JSON to readable YAML, with block strings for multi-line text. - [JSON string escape](https://sentrint.com/tools/everything-json/json-escape): Escape a block of text so it is a valid JSON string value, or unescape one back. - [JSON in a URL](https://sentrint.com/tools/everything-json/json-in-url): Percent-encode a JSON value for a query parameter, or decode one back and pretty-print it. - [JSON key sorter](https://sentrint.com/tools/everything-json/json-sort-keys): Reorder every object's keys alphabetically so two documents diff cleanly. - [JSON flattener](https://sentrint.com/tools/everything-json/json-flatten): Collapse nested JSON to a single level of dotted paths, and expand it back. - [JSON Patch playground](https://sentrint.com/tools/everything-json/json-patch): Apply an RFC 6902 patch to a document and watch each operation take effect. - [JSON merge](https://sentrint.com/tools/everything-json/json-merge): Deep-merge two documents, with a choice of replacing or concatenating arrays. - [JSON redact](https://sentrint.com/tools/everything-json/json-redact): Mask the values of sensitive keys before you paste a config into a ticket or chat. - [JSON Schema generator](https://sentrint.com/tools/everything-json/json-schema): Infer a JSON Schema from an example document, with types, required keys and common formats. ## Start - [Start here](https://sentrint.com/wiki/start-here): The Sentrint wiki, in reading order. What a security scan checks in a vibe-coded app, what a report tells you, and what happens to your code. - [Why Sentrint exists](https://sentrint.com/wiki/why-sentrint-exists): AI and no-code tools ship working apps with real security holes. Sentrint gives non-security builders a fast, honest read on what is exposed. - [FAQ & glossary](https://sentrint.com/wiki/faq-glossary): Straight answers to the questions founders ask before running a scan, plus a plain-English glossary of the security terms you will see in a report. ## Product - [How a scan works](https://sentrint.com/wiki/how-a-scan-works): What happens from the moment you sign in to the moment you get a report. Sign in, pick a repo, get a score, a grade, findings and a fix prompt. - [Reading your report](https://sentrint.com/wiki/reading-your-report): What the score, the letter grade and the severity levels mean, what to fix first, and how a rescan confirms a fix is really gone. - [Security fix prompts: apply, then recheck](https://sentrint.com/wiki/the-fix-prompt): A copy-paste fix prompt for Lovable, Bolt, Cursor or v0 with every finding, in small steps, so your AI builder fixes one thing at a time. - [Plans and what they include](https://sentrint.com/wiki/plans): One free scan a month, no card, with the full report and the fix prompt. Top-up adds six scans, Founder gives you 36 a month across up to 15 repos. - [Inside the security engine](https://sentrint.com/wiki/security-engine): How the scan works under the hood, the rule families it runs, the AI review layer that filters false positives, and how findings get scored. - [Sentrint for developers](https://sentrint.com/wiki/for-developers): The severity model in detail, the fix-and-rescan workflow, the embeddable security badge, and where this fits alongside code review and CI. - [Run scans from your codebase](https://sentrint.com/wiki/api-quickstart): Create a scoped Sentrint API key, submit a GitHub scan, read findings, and import the API into Postman or Insomnia. - [Developer API reference](https://sentrint.com/wiki/api-reference): Sentrint API v1 reference. Bearer API key auth, scan submission, findings, pagination, errors and scan deletion, with cURL, Python and Node.js examples. - [Run a security scan in GitHub Actions](https://sentrint.com/wiki/github-actions-security-scan): Scan your repo on every push with the Sentrint API and fail the build on Critical or High findings. Workflow file plus Bash, Python and JavaScript scripts. - [Security MCP server for AI coding agents](https://sentrint.com/wiki/mcp): Connect your coding agent to Sentrint's MCP server by URL, or locally with npx -y @sentrint/mcp. Browser sign-in, tools, limits, errors and security. ## Security basics - [Security for AI-built apps](https://sentrint.com/wiki/ai-built-app-security): Apps built with Lovable, Bolt, Cursor, Replit and v0 ship the same handful of security holes. What they are, and what each one lets an attacker do. - [Common vulnerabilities, explained](https://sentrint.com/wiki/common-vulnerabilities): A plain-English tour of the security holes that show up in AI-built apps, what each one is, how it happens, and what a finding looks like. ## Trust - [Your code and your data](https://sentrint.com/wiki/your-code-and-data): Your repository is never written to our database. What a scan reads, the one piece of code we keep for 30 days, and the rights you have over all of it. ## Guides by AI coding tool - [Why AI-generated code keeps shipping XSS, and the four places it hides](https://sentrint.com/blog/xss-in-ai-generated-code): Georgetown's CSET found XSS in 86% of AI-generated samples. React escapes output everywhere except the four spots a model reaches for to render rich text. - [A v0 security checklist for the Next.js app you just exported](https://sentrint.com/blog/v0-security-checklist): v0 writes idiomatic Next.js, so it fails the way Next.js fails: authorisation in middleware, server actions with no caller check, secrets in client code. - [Supabase RLS: test grants, policies and user access](https://sentrint.com/blog/supabase-rls-for-ai-built-apps): Grants and RLS policies are separate checks. Learn default-deny behavior, safe insert policies, view permissions, and how to test access in Supabase. - [Six security checks you can run on your own SaaS in 15 minutes](https://sentrint.com/blog/six-security-checks-in-15-minutes): The same mistakes show up in almost every app built fast. Six checks, no tools needed, each with the command to run and what a failure looks like. - [Write a security rules file once, and every prompt inherits it](https://sentrint.com/blog/security-rules-file-for-ai-coding-tools): CLAUDE.md, AGENTS.md and .cursorrules are read on every request. A copy-paste security rules file, and the four rules worth putting in it. - [Deleting the key from the file does nothing. It is still in your git history](https://sentrint.com/blog/secrets-in-git-history): A secret committed once stays in every clone, fork and CI cache until you rotate it. Rotate first. Rewriting history is cleanup, and it comes second. - [Your app calls an LLM. Everything your users type is now instructions](https://sentrint.com/blog/prompt-injection-in-your-own-app): If your app sends user text to a model, the model can't tell it apart from your prompt. Better wording won't fix that. Limiting what it can reach will. - [Your paywall is a CSS rule. Here is what it costs and how to fix it](https://sentrint.com/blog/paywall-bypass-in-ai-built-apps): Hiding a premium feature is presentation. Checking the plan is authorisation. Generated apps usually do only the first, and devtools shows the gap. - [The package was real, popular and compromised. Your agent installed it anyway](https://sentrint.com/blog/npm-supply-chain-for-ai-built-apps): Shai-Hulud steals npm, GitHub and cloud tokens through postinstall scripts, then republishes itself. In August 2026 it reached keyv and 400+ packages. - [A Lovable security checklist you can finish in an evening](https://sentrint.com/blog/lovable-security-checklist): Nine checks for a Lovable app before real users arrive. What to click, what a failure looks like, and a prompt to paste back into Lovable to fix it. - [Is v0 safe? The generated code is the whole question](https://sentrint.com/blog/is-v0-safe): v0 gives you React and Next.js code that you deploy, so more of the security is on you than with a hosted builder. The four checks that matter most. - [Is Replit safe? Security checks for your app](https://sentrint.com/blog/is-replit-safe): Replit's agent once deleted a live database. Replit now separates dev and production and scans code before publishing. What to check in your own app. - [Is Lovable safe? What its security scans cover, and what is still yours](https://sentrint.com/blog/is-lovable-safe): Lovable now runs a free scan on every publish and a free Deep scan of your code. What each checks, when that is enough, and what is still yours to test. - [Is Cursor safe? The editor and the code it writes are two questions](https://sentrint.com/blog/is-cursor-safe): Cursor has had three rounds of remote code execution flaws, all patched, all needing you to open something hostile. Nobody audits the code it writes. - [Is Bolt safe? The platform is certified. Your app is not covered by that](https://sentrint.com/blog/is-bolt-safe): Bolt is SOC 2 Type 2 certified and offers a free security audit before publish. What that audit checks, and what you still have to test in your own app. - [Is Base44 safe? Security checks before you launch](https://sentrint.com/blog/is-base44-safe): Base44 fixed two serious platform flaws in 2025 and now ships its own security scan. What that scan checks, and what you still have to test in your app. - [Your AI invented a package name. Someone else registered it](https://sentrint.com/blog/hallucinated-packages-slopsquatting): An LLM invents a dependency that doesn't exist, and an attacker registers that exact name. One fake package reached 237 repositories. How to check yours. - [Every MCP server you added is code you never read](https://sentrint.com/blog/cursor-mcp-server-risks): An MCP server describes its own tools and your agent trusts the description. Two Cursor CVEs came from that, and the general problem isn't a bug to patch. - [Can one of your users read another user's data? Here is how to find out](https://sentrint.com/blog/can-another-user-see-my-data): Broken object level authorisation is the most common serious flaw in AI-built apps, and testing your own account never finds it. A 20-minute test. - [A Bolt security checklist for the hour before you share the link](https://sentrint.com/blog/bolt-security-checklist): Eight checks for a Bolt app, in the order an attacker would find them. Most take two minutes with a browser, a second account and your Supabase dashboard. - [API key exposed in your frontend? How to find it and fix it](https://sentrint.com/blog/api-keys-in-frontend-code): A key in your browser bundle is public. Which keys are meant to be there, how to find the rest in a live app, and how to rotate and move them server-side. - [What the research actually says about AI-generated code security](https://sentrint.com/blog/ai-code-security-statistics): Eleven numbers people quote about AI code security, what each study measured, and which survive a look at the method. Updated as new research lands. ## Optional - [Full text](https://sentrint.com/llms-full.txt): every wiki article and guide above in one Markdown file. - [Wiki index](https://sentrint.com/wiki): every page above, grouped. - [Blog](https://sentrint.com/blog): dated, signed guides — one per AI coding tool per reader question. Where the wiki explains the product, these explain a specific platform's security and how to check it. - [Privacy](https://sentrint.com/privacy): what is collected, and what is not retained. - [Terms](https://sentrint.com/terms): the agreement covering use of the service.