Overview

Security that fits how you already build.

BoringSec catches the security gaps AI tools leave behind — hardcoded secrets, broken RLS, missing auth, unsafe patterns — and hands you copy-paste fixes for Cursor, Lovable, Bolt, and every other AI coding tool.

Why BoringSec

Built specifically for AI-generated code (Cursor, Lovable, v0, Bolt)

17 public modules maximize findings before verification. 6 owner-only heavy scanners settle later

Fix prompts optimized per platform — copy, paste, done

Supabase RLS live testing — actually queries your DB with the anon key

Detects Clerk middleware gaps, Stripe webhook bypass, Firebase rules

Free preview — see available finding names, category counts, severity counts, and coverage state

REST API for CI/CD — fail builds on critical vulnerabilities

Claude Code MCP plugin — security checks as you code

Quick start — scan via API

Queue with one curl command, then poll the returned status link. No SDK needed.

curl

JOB=$(curl -sS -X POST https://www.boringsec.com/api/v1/scan \
  -H "$(printf 'Authorization: Bearer %s' "$BORINGSEC_API_KEY")" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-app.com", "async": true}')

echo "$JOB" | jq '.scan | {id, status, links}'

The endpoint returns HTTP 202. Poll scan.links.status every five seconds, then fetch scan.links.result. An API key authenticates the request, but the in-process Injection, XSS, and Ports scanners and the external Nuclei, ZAP, and Medusa engines are admitted only for a non-anonymous scan of a domain owned by the signed-in user or team and marked VERIFIED.

Get your API key from Settings → API Keys (Pro plan). All requests use Authorization: Bearer bsk_your_key.

Developer guides

REST API reference

15+ endpoints: scan URLs, code and GitHub repos, get fix suggestions, generate .cursorrules, check usage.

1-click

Install BoringSec MCP

Beginner-friendly copy-paste setup for Claude Code and Cursor with device login. No raw API key handling.

MCP

Claude Code MCP plugin

Full MCP reference: tools, privacy boundaries, CI commands, policy packs, waivers, and governance.

CI/CD & IDE

Wire BoringSec into GitHub Actions, GitLab CI, and your editor to fail builds on critical findings.

What BoringSec scans

The public registry currently contains 17 pre-verification URL modules plus 6 verified-owner heavy scanners (3 external engines). All 17 public modules maximize available findings and coverage information before ownership verification. Public and anonymous scans run those modules only and do not publish a final score or grade. Injection, XSS, and Ports, plus the external Nuclei, ZAP, and Medusa engines, require a signed-in, non-anonymous scan of a domain owned by that user or team and marked VERIFIED. A requested engine without that authorization is reported as authorization_required. An engine that was not requested is not_requested. Eligible jobs run independently in the background and update the same report when ready without blocking or retracting the base result.

Secret detection

AI tools often hardcode API keys straight into your source. We detect 11 provider-specific patterns: Supabase, Stripe, OpenAI, Anthropic, AWS, GitHub, Firebase, and more.

Finds the Stripe key your Cursor session left in the bundle.

Scan for secrets

Supabase & Firebase security

We actually query your Supabase instance with the anon key to test whether RLS is enforced, audit Firebase Security Rules, and detect exposed service_role keys.

Uses live, evidence-backed RLS checks where the target permits them.

Test your RLS

Auth & middleware gaps

Clerk publicRoutes wildcards, missing Next.js middleware, JWTs in localStorage, OAuth email-linking flaws — eight auth-specific patterns.

Catches the "everything is public by default" mistake.

Check your auth

Injection, XSS & SSRF

SQL, command and template injection, DOM-based and reflected XSS, SSRF via user-controlled URLs, and mass assignment with Prisma.

Finds the attack vectors AI-generated code commonly introduces.

Fix prompts (42+ templates)

Every issue comes with a copy-paste fix prompt optimized for your specific AI tool — Cursor, Lovable, Bolt, Claude Code, v0, Windsurf or Replit.

Fix a critical vulnerability in 2 minutes, not 2 hours.

Browse templates

.cursorrules / AGENTS.md generator

Generate stack-specific security rules that make every future AI coding session security-aware — Next.js + Supabase, Firebase, Clerk and Stripe stacks.

Prevention beats detection. Stop vulnerabilities before AI writes them.

Generate rules

Checks at a glance

These are examples inside the 20 in-process URL modules, not an aggregate promise that every target runs the same number of atomic probes. The exact branches depend on the target response, detected stack, authorization, and upstream availability. See the scanner reference for the evidence contract.

Security headers

7 checks

SSL / TLS

5 checks

DNS (SPF/DKIM/DMARC)

4 checks

Exposed files

4 checks

Cookies

3 checks

CORS

2 checks

XSS

2 checks

SQL injection

3 checks

Supabase RLS

3 checks

Firebase rules

2 checks

Hardcoded secrets

11 patterns

Unsafe code

15 patterns

Vulnerable deps

20+ packages

GDPR

3 checks

Bundle secrets

2 checks

WAF detection

1 check

Legal and authentication coverage

Privacy, consent, and data rights signals

implemented

Public website content and observable privacy controls. The report records observable consent, tracking, privacy-notice, retention, and data-rights signals with supporting evidence.

Limit: Automated observations are not a legal assessment or proof of compliance. Missing evidence is reported as partial or not observed.

Terms, WCAG basics, and public notices

implemented

Public website content and explicitly linked notices. The report records observable terms, accessibility basics, page metadata, and public notices independently.

Limit: This is not a full WCAG audit, legal opinion, intellectual-property clearance, or proof that a document is enforceable in every jurisdiction.

Public authentication signals

implemented

Publicly observable authentication and session signals. The public scan checks browser-visible security configuration without signing in or changing application state.

Limit: Account-level authorization and identity controls require owner-authorized testing or manual review and are not marked as passed by a public scan.

Authenticated application surface

conditional

Verified-owner domains with an explicitly configured, expiring credential profile. Optional credentials remain server-side and are used only within an isolated, owner-authorized scan for the verified site. Public reports never expose credential names or values.

Limit: Coverage depends on the configured access and application behavior. Controls that were not assessed are reported as unavailable or partial, never as passed.

Repository auth and authorization patterns

conditional

User-authorized repository or archive scan. Authorized source analysis checks selected authentication, authorization, secret, dependency, and integration patterns.

Limit: Source patterns are evidence leads, not runtime proof. Business-object ownership and role policy still require dedicated authorized tests or manual review.

AI data boundary

AI-assisted features are optional. Core scanning, scoring, and reports continue without external model processing. AI generation runs only when an AI analysis or guidance feature is explicitly requested and available. It is not required to calculate the Security Score.

Only the limited report context and relevant findings needed to produce the requested analysis are sent. Data is minimized before any external transfer.

The analysis payload does not intentionally include account passwords, scan credentials, cookie values, full page bodies, raw source archives, payment-card data, or full secret values.

Any enabled external provider is disclosed in the Privacy Policy or service-provider inventory. Its published data-handling terms apply to the minimized data transferred for the requested feature.

Ready to ship secure?

Start with a free scan. No account required. See exactly what AI left exposed.

Scan now — free API docs

API base URL

https://www.boringsec.com/api/v1

Authenticate with Authorization: Bearer bsk_your_key. Rate limits: Pro 100/hr, Team 1000/hr, Enterprise 5000/hr. See pricing for plan details.