Score it. Fix it. Keep it safe.
Kavach runs a loop most AI-built apps never get: a senior engineer’s review, a fix you can apply without knowing how to code, and a watchful eye on every change after that.
- 01Score
Kavach reads the whole app and rates how safe it is to launch.
- 02Fix
Each risk comes with a prompt for your AI tool. Paste and push.
- 03Watch
Every new change is checked against everything Kavach knows.
- 04Prove
Show customers and investors your live score on a trust page.
One number that answers “is it safe to launch?”
Kavach checks your code, dependencies, secrets, access rules, database and cloud config, and AI-specific risks like prompt injection. Then it does what scanners don’t: it measures each risk by what you would actually lose.
- Score from 0 to 100, updated every push
- Risks ranked by blast radius
- Crown jewels found automatically
- Secrets and leaked keys
- Vulnerable dependencies
- Missing auth and access rules
Fixes written for your AI, not your engineers.
Every risk becomes a precise instruction for Cursor, Lovable, Bolt, v0, Replit or Claude Code, scoped so your AI changes only what it should. When you push, Kavach re-checks and moves your score.
Anyone logged in can delete any account.
The route checks that someone is signed in, but never checks that the account belongs to them. One request with another user’s id deletes their data.
In Cursor, open app/api/users/[id]/route.ts.
In the DELETE handler, after getting the session user,
return 403 unless session.user.id === params.id
or session.user.role === 'admin' (read the role from
the database, not from the request).
Do the same check in the GET and PATCH handlers in
this file. Don't change anything else.
Add a test: user A deleting user B gets 403.A reviewer that remembers.
Most AI reviewers see one diff at a time. Kavach reviews each push and pull request against the whole app: your crown jewels, your past fixes and the risks you chose to accept. It explains the change in plain English, blocks what’s dangerous and keeps every decision in a ledger.
Every review, decision and accepted risk is kept, so the next review knows your history and nothing gets quietly forgotten.
- today#142 invites reusableblocked · fix suggested
- mon#139 payouts refactorcertified review · approved by a Kavach engineer
- fri#136 rate limit /api/chatcloses a finding from the first scan
- sep 30#131 public share linksaccepted risk · revisit in 30 days
- sep 22#97 reset tokens single-usefixed · rule learned
The documentation nobody wrote.
Architecture, user flows, every API, the hidden behaviour and the tricky parts, generated from your code and rebuilt on every push. Hand it to a new developer, an investor’s tech reviewer or a buyer. Click around this sample.
Auto-generated from your code. Click any box to jump to the files behind it.
Checkout flow 6 steps · 4 files
- User clicks "Upgrade"components/Pricing.tsx
- Browser posts plan + price to /api/checkoutapp/api/checkout/route.tsprice comes from the client
- Server creates a Stripe sessionlib/stripe.ts
- User pays on Stripeexternal
- Stripe calls /api/webhookapp/api/webhook/route.tssignature not verified
- Order marked paid, plan unlockeddb.orders · db.users.plan
| Method | Route | Auth | What Kavach noticed |
|---|---|---|---|
| GET | /api/products | public | Reads catalog. Cached 60s. |
| POST | /api/checkout | session | Trusts price from the request body. |
| POST | /api/webhook | none | No Stripe signature check. |
| GET | /api/users/[id] | session | Returns any user, not just you. |
| DELETE | /api/users/[id] | none | Anyone can delete any account. |
| POST | /api/chat | session | Streams from OpenAI. No rate limit. |
| GET | /api/admin/stats | admin | Role checked on the server. |
This is a subscription app with an AI chat assistant. People sign up with email, get a 14-day trial, pay through Stripe, and chat with a model that can see their past orders.
Things you might not know it does
- hidden Sends the user's email and last 5 orders to OpenAI with every chat message.
- hidden Deletes trial accounts after 14 days, with no warning email and no backup.
- tricky Two different "user" types exist (
profilesandusers) and they can drift apart. - tricky Admin is anyone whose
rolecolumn says so, and the dashboard lets users edit their own profile row.
Ranked by what an attacker gains, so you protect the right thing first.
Anyone can mark an order as paid by posting fake JSON.
Checks you are logged in, not that the account is yours.
The browser key can read every row in "orders".
NEXT_PUBLIC_ prefix bundles the key into client JS.
An outdated image library has a published path traversal fix.
Proof, not promises.
A public page with your live Kavach Score and the checks you pass, plus a badge for your footer. You choose what to show; it never reveals code or the details of a finding.
- Live score, updated on every push
- Custom domain and branding
- Answers for security questionnaires
- Branded pages per client (Studio)
- ✓No exposed secrets or keys
- ✓Customer data protected by access rules
- ✓Payments verified server-side
- ✓Dependencies free of known critical issues
- ✓Every change reviewed before release
- ✓Human security review · Sep 2026
Real engineers, on request.
On the Certified plan, a Kavach security engineer reads your code. Ask for it on any pull request, or book a full audit before a launch, a fundraise or a big customer.
- 01Request
Click “Ask a human” on a PR, or book an audit from your dashboard.
- 02Matched
An engineer who knows your stack picks it up, with Kavach’s full report as a head start.
- 03Reviewed
A written review lands on the PR within one business day, with fixes and fix prompts.
- 04Certified
Walk through it on a call. Your trust page gets a “human reviewed” mark.
Not another wall of warnings.
| Hoping for the best | Security scanner | Hiring a senior engineer | Kavach | |
|---|---|---|---|---|
| Finds vulnerabilities | – | ✓ | ✓ | ✓ |
| Says what each risk would cost you | – | – | ✓ | ✓ |
| Explains how your app works | – | – | ✓ | ✓ |
| Fix you can apply without coding | – | – | – | ✓ |
| Reviews every change, with memory | – | – | when free | ✓ |
| Proof you can show customers | – | – | – | ✓ |
| Cost | $0 until it isn’t | $$ | $$$$ | from $0 |
A security product should act like one.
The GitHub app asks only to read the repos you pick. Kavach never pushes code on its own.
Each scan runs in its own short-lived sandbox that is destroyed when it finishes.
Your code is used to build your score, reports and reviews. Nothing else.
Disconnect a repo and its copy, reports and history are removed.
See your score. Then watch it climb.
Connect GitHub with read-only access, pick a repo and get your Kavach Score, your biggest risks and the prompts that fix them. No credit card.
This removes the
invite.usedcheck, so one invite link can now be reused forever, and its role can beadmin. Anyone who sees a forwarded link can join as an admin.memory · same pattern was fixed in #97 (password reset tokens). You marked tokens as a crown jewel.