AI builders ship code that works — not code that's safe. Leaked keys, open databases, admin routes with no lock. Hullchecks inspects your app from the code to the live site and hands you the exact fix for each hole.
$ hullcheck ./my-app
Paste a live URL or drop a project zip. A full inspection takes about a minute.
Reads only your site's public surface. Nothing is stored. Private addresses are refused.
~60s
to a full inspection
Offline sandbox
your code never runs or leaves
OWASP · SOC 2 · GDPR
every finding mapped to controls
Nothing stored
deleted after every inspection
What AI builders leave behind
The tools optimize for it works — not it's safe. Here's what a hullcheck pulls out of a typical repo:
createClient(url, process.env.SUPABASE_SERVICE_ROLE_KEY)↳ Your service key ships inside the browser bundle — anyone can read every row in your database.
alter table profiles disable row level security;↳ Row-level security is off. Every signed-in user can read and edit everyone else's data.
if (req.query.isAdmin) return grantAccess()↳ The admin gate trusts a flag the client sets. Append ?isAdmin=1 and you're in.
"react-toastify-secure": "^1.0.0"↳ A package your agent hallucinated. It doesn't exist yet — until an attacker registers the name.
The whole lifecycle
A live-URL scan never sees the secret shipped to the browser or the package your agent installed. Hullchecks rides along from the first prompt to production — every stage feeds one grade.
Secrets, injection, broken auth, vulnerable deps — read in a sandbox that never runs it.
A CLI, Action, and pre-commit hook on every commit and PR — code never leaves the machine.
An MCP server so Claude Code, Cursor, and Windsurf catch it while you're still prompting.
Headers, CORS, exposed .env and .git, TLS, SPF/DMARC, takeover — behind strict SSRF guards.
every stage feeds one number
How it works
Paste a URL, drop a zip, run the CLI, or connect a repo. No agent install, no config.
Pinned scanners run offline in a locked-down sandbox — secrets, deps, code flaws, live surface, supply chain.
One A–F grade with the math shown, findings ranked by real risk, and a one-click PR for the mechanical ones.
The score
Deterministic — the same project always scores the same, and no language model touches the math. One leaked key puts you below the waterline, however clean the rest is. Re-inspect after a fix and watch the hull rise.
18/100
Below the waterline
Compliance
"Are you SOC 2?" can end a deal. Hullchecks maps every finding to OWASP Top 10, SOC 2, and GDPR controls, shows exactly where you stand, and exports the evidence — so you answer the 200-item security questionnaire in an afternoon, not a quarter.
We get you audit-ready and hand you the evidence; the formal certificate comes from a licensed auditor — we shorten the road to it.
SOC 2 readiness
Why a hullcheck
| Hullchecks | Traditional scanners | Just asking your AI | |
|---|---|---|---|
| Fixes in plain English, not CVE codes | sometimes | ||
| Sees code, CI, agent, and live site | code only | ||
| One deterministic A–F grade | |||
| No security expertise needed | |||
| Runs offline, nothing stored | varies | ||
| Catches typosquatted / hallucinated deps | varies |
Built for the AI stack
An agent in your editor or an app builder in your browser — we inspect what it left behind.
Private by design
We sell trust, so we treat your code the way we'd want ours treated.
Your code
URL or zip
Offline sandbox
no network · never executed
Findings + grade
source deleted
Offline sandbox
Every inspection runs with no network access. We read your code — we never run it.
Nothing stored
Your code and uploads are deleted the moment the report is written. We keep the findings, not your source.
Proven engines
Built on the scanners security teams already trust — Gitleaks, Semgrep, and Trivy — pinned and run offline.
Pricing
The free hullcheck is free, forever — no login. Connected repos, continuous monitoring, auto-fix PRs, your Seaworthy badge, and compliance reports come with Pro.
One inspection, about a minute, no login — and you'll know exactly what to fix and how.
Run a hullcheck