The key in the browser.
Your AI put an API key in the frontend so the feature would work. A bot finds it overnight. You find out from your card statement.
caught by → Secrets scan · blast radiusFor apps built with Cursor, Lovable, Bolt, v0 & Claude CodeAI built your app.
AI built your app.
Who’s checking
its work?
Kavach is the senior engineer and security team your app never had. It learns your whole codebase, tells you what could hurt you and what it would cost, then hands you the prompt that fixes it. After that, it checks every change.
✓ read-only GitHub access✓ no credit card✓ no code knowledge needed
acme/vibe-saasfirst scan · 2 min ago
Kavach ScoreNot launch-ready
3 issues could cost you customers or money this week.
- criticalfixedAnyone can mark an order as paidWebhook signature verifiedblast radius Free products, lost revenue
- criticalfixedCustomer table readable from the browserRow-level security onblast radius 12,400 emails and phone numbers
- highfixedOpenAI key shipped to every visitorKey moved server-side, cappedblast radius Uncapped bill on your card
paste into Cursor, Lovable or Claude Code → Kavach re-checks
Speaks the language of
CursorLovableBoltv0ReplitClaude CodeCopilotWindsurf
Why this mattersAI made building free.
AI made building free.
Mistakes still cost money.
Your AI writes code that works. It doesn’t tell you what it gave away to make it work. Four ways that goes wrong:
The rule that got switched off.
To fix an error, the AI disabled a database access rule. Every customer’s email and phone is now one request away.
caught by → Crown jewels · access checksThe change you didn’t ask for.
You asked for a new button. The AI also rewrote part of checkout. Nobody notices until refunds start coming in.
caught by → Change WatchThe app nobody can touch.
A developer you want to hire, an investor’s tech review, a buyer for the business. They all ask how it works. You can’t say.
caught by → Owner’s manualWhat you get
The engineering team you couldn’t afford.
A security lead, a reviewer, an architect and a fixer cost more than most apps earn in their first year. Kavach does their jobs for the price of a lunch, and calls in real engineers when it matters.
Security lead
Kavach Score
One number from 0 to 100 that answers “is this safe to launch?”, with every risk in plain English.
Risk analystBlast Radius
Each risk is measured in what you’d lose: records exposed, money at stake, who could do it.
FixerFix Prompts
Paste-ready prompts for Cursor, Lovable, Bolt or Claude Code. Kavach re-checks when you push.
Code reviewerChange Watch
Every PR explained in plain English, with alerts when your AI touches something that matters.
ArchitectOwner’s Manual
Architecture map, user flows, every API and the hidden behaviour, kept current on every push.
Real humansCertified Review
Security engineers review the PRs and launches that matter too much to leave to a bot.
Kavach Score · Blast Radius
Is it safe to launch? Find out.
Pick a sample app and watch Kavach score it. Connect GitHub to score yours, free.
or try
kavach scansample output
$ kavach scan --explain
Pick an app above to watch it get scored.
Fix Prompts
We don’t send you homework. We send the fix.
Security tools tell you what’s wrong in words only engineers understand. Kavach writes the instruction for the AI tool you already use: which file, what to change, what to leave alone. Paste, push, and Kavach confirms it’s fixed.
criticalapp/api/users/[id]/route.ts:41
Anyone logged in can delete any account.
The route checks that someone is signed in, but never checks that the account belongs to them. One request with another user’s id deletes their data.
blast radiusEvery one of your 12,400 users
effort to exploitOne line in the browser console
fix prompt for
In Cursor, open app/api/users/[id]/route.ts.
In the DELETE handler, after getting the session user,
return 403 unless session.user.id === params.id
or session.user.role === 'admin' (read the role from
the database, not from the request).
Do the same check in the GET and PATCH handlers in
this file. Don't change anything else.
Add a test: user A deleting user B gets 403.→ Kavach re-checks when you pushGet fix prompts for my app →
Change Watch
“What did my AI just do?”
Every push and pull request is checked against everything Kavach knows about your app: your crown jewels, your past fixes, your accepted risks. It explains the change in plain English and stops the dangerous ones. One click sends it to a human.
● open
Add team invites #142feat/invites → main · 4 files · +212 −18
app/api/invites/[token]/route.ts
18 const invite = await db.invites.find(token)
19- if (!invite || invite.used) return notFound()
19+ if (!invite) return notFound()
20+ await db.members.add(invite.teamId, user.id, invite.role)
Change Watch · ledgeralways on
Every review, decision and accepted risk is kept, so the next review knows your history and nothing gets quietly forgotten.
- today#142 invites reusableblocked · fix suggested
- mon#139 payouts refactorcertified review · approved by a Kavach engineer
- fri#136 rate limit /api/chatcloses a finding from the first scan
- sep 30#131 public share linksaccepted risk · revisit in 30 days
- sep 22#97 reset tokens single-usefixed · rule learned
Kavach Score88 ↑ 47
PRs reviewed142
Owner’s Manual
Own your app, not just its code.
Kavach draws the architecture, traces every user flow, lists every API and spells out what the code really does. The manual updates itself, so it’s ready the day you hire a developer, face a tech review or sell the business.
- Architecture mapevery service and how they connect
- User flowssign-up, checkout, reset, step by step
- API inventoryevery route and who can call it
- Hidden behaviourwhat it does that nobody asked for
kavach · acme/vibe-saas @ main
Browser
Next.js app38 pages
/api23 routes
AuthSupabase
Stripe webhook⚠ no signature check
Postgresusers · orders★ crown jewel
OpenAIchat.ts
214 files23 endpoints6 flows3 critical4 crown jewels
Trust Page
Turn security into a selling point.
Customers, investors and enterprise buyers all ask “is this safe?”. Answer before they ask. A public trust page and footer badge show your live Kavach Score and the checks you pass, without revealing a line of code.
- Shorter security questionnaires
- Proof for investors’ technical due diligence
- Agencies: hand every client a branded page
A
Acme InvoicesSecurity overview, kept current by Kavach
● monitoredKavach Score94checked on every change · last 3 hours ago
- ✓No exposed secrets or keys
- ✓Customer data protected by access rules
- ✓Payments verified server-side
- ✓Dependencies free of known critical issues
- ✓Every change reviewed before release
- ✓Human security review · Sep 2026
Who it’s for
Built for people who build with AI.
Solo builders
Launching your first paid app and want to sleep the night it goes live.
Non-technical founders
Hiring your first developer, raising a round or selling to bigger customers, and you need to know what you own.
Agencies and freelancers
Shipping AI-built apps for clients. Hand over a trust page and an owner’s manual, not a mystery.
Teams adopting AI coding
Half your PRs are AI-written now. Keep a senior engineer’s eye on all of them.
Certified Review
When it really matters, a real engineer.
Launching, raising money or touching payments? Send any PR, or your whole app, to a Kavach security engineer. You get a written review, a call to walk through it and a “human reviewed” mark on your trust page.
- PR reviewsA person reads the change in context, not just the diff.
- Launch auditsA full manual pass before launch, a raise or a big deal.
- 1 business dayTypical turnaround on a pull request.
- Due-diligence packThe report investors and enterprise buyers ask for.
Pricing
Less than one hour of a security consultant.
Start with a free score. Upgrade when you want Kavach watching every change.
Scan
Find out if your app is safe to launch.
$0forever
no card needed
Get my Kavach Score- 1 app
- Kavach Score, re-checked monthly
- Top 3 risks with blast radius
- Fix prompts for those 3
- Owner’s manual: map, flows and APIs
Guard
A senior engineer watching every change.
$24/month
billed yearly
Start 14-day trialEverything in Scan, plus
- 3 apps
- Every risk, with fix prompts
- Change Watch on every push and PR
- Alerts when a change touches a crown jewel
- Public trust page and badge
- Review ledger with full history
Studio
For agencies and teams shipping AI-built apps.
$79/month
billed yearly
Start 14-day trialEverything in Guard, plus
- 20 apps, 10 seats
- Branded trust pages for each client
- Merge checks that block critical risks
- Custom review rules
- Handover reports for clients
- Slack alerts
Certified
Real security engineers on your code.
$399/month
billed yearly
Talk to usEverything in Studio, plus
- 4 human PR reviews a month
- Full manual audit each quarter
- “Human reviewed” mark on your trust page
- Investor and customer due-diligence pack
- Extra reviews from $149 each
Questions
Good questions.
I can’t read code. Is this for me?
Yes, it’s built for you. Every risk is written in plain English with what it could cost, and comes with a prompt you paste into the AI tool you already use. You never have to touch the code yourself.
What is the Kavach Score?
A 0–100 rating of how safe your app is to put in front of real users. It weighs each risk by its blast radius: how much data or money is exposed and how easy it is to exploit. It updates every time you push.
How do fix prompts work?
For each risk, Kavach writes a precise instruction for your AI tool (Cursor, Lovable, Bolt, v0, Claude Code and others) saying which file to change, what to change and what to leave alone. You paste it, push, and Kavach re-checks to confirm the fix worked.
What does Kavach need access to?
Read-only access to the GitHub repositories you choose. Kavach never pushes to your code.
Is my code used to train AI models?
No. Your code is used only to produce your score, reports and reviews.
How is this different from a security scanner?
Scanners hand you a list of warnings written for security engineers. Kavach understands the whole app first, tells you what each risk would cost you, gives you the fix in a form your AI can apply, and keeps watching every change after that.
What is the trust page?
A public page, with a badge for your site’s footer, that shows customers and investors your Kavach Score and the checks you pass. It only shows what you choose to share, never your code or the details of a finding.
Free for your first app
Your app is already live. Know your score.
Connect GitHub with read-only access, pick a repo and get your Kavach Score, your biggest risks and the prompts that fix them. No credit card.
This removes the
invite.usedcheck, so one invite link can now be reused forever, and its role can beadmin. Anyone who sees a forwarded link can join as an admin.memory · same pattern was fixed in #97 (password reset tokens). You marked tokens as a crown jewel.