Keybrum
Keybrum is an independent automated attacker for applications built with AI. It tests live apps like a hacker would, proves exploitable data leaks and exposed keys, gives coding agents fixes, and retests until the attack fails.
At a Glance
- Founders and makers shipping several AI-built apps
- Agencies and small teams testing client applications
- Companies whose staff build apps with AI tools
- Developers using Lovable, Bolt, Replit, v0, Cursor, Claude Code or Base44
- +1 more
AI Tools by Keybrum
(1)
Keybrum
Automated Pentesting for Vibe Coded Apps
Discussions
No discussions yet
Be the first to start a discussion about Keybrum
Latest News
Keybrum published its CVE-2025-48757 research page on the Lovable RLS flaw, including the reported scan result that 170 of 1,645 Lovable apps tested had inadequate RLS.
Keybrum's CVE watch covered the public disclosure of CVE-2025-29927, the critical Next.js middleware authorization bypass, and explained how its live attack proves the behavior.
Keybrum highlighted CVE-2025-55182 in its automated-pentest research as an example of a newly disclosed, actively exploited framework issue that continuous deploy testing can catch.
Keybrum updated its terms of service and privacy policy, detailing its attack service, ownership controls, non-destructive testing, data retention and Polar payment processing.
Products & Services
A proof-based external attack service for live apps. It maps browser-visible backends and keys, tests signed-out and signed-in access, reports only attacks that worked, supplies redacted proof and fixes, and retests the finding.
A one-time full attack run for one app, including proof for findings, coding-agent fix prompts, seven days of retests and a PDF report.
Paid plans can attack apps weekly and on every deploy, run CI checks, send Slack alerts and provide a public trust page and badge.
An MCP integration through which agents can list apps and findings, retrieve proof and fixes, retest findings, run full attacks and conduct source-audit workflows.
Market Position
Keybrum positions itself as a proof-based automated penetration-testing service for AI-built apps, rather than a conventional vulnerability scanner: it sends attacks and reports what actually worked, supports two-account access-control testing, hands fixes to coding agents and retests them. Its own comparison distinguishes automated pentests from scanners and manual pentests; it says automated testing is strongest for repeatable access-control and configuration flaws, while manual pentesting remains important for business logic, human/physical testing and audit needs.
Founding Story
Keybrum says AI builders can ship a working app quickly but often do not check what an attacker can do with it; it was built to provide that missing attacker. Its stated initial vision was proof-based, safe testing of live AI-built apps rather than simply reporting possible weaknesses.
Business Model
Revenue Model
Paid one-time reports and recurring monthly or annual subscriptions. The one-time report covers one full attack run and seven days of retests; subscriptions cover multiple apps and ongoing weekly/deploy testing, with higher tiers adding members, branding, unlimited runs or app-discovery features.
Pricing Tiers
One app and one full attack run; proof, agent fix prompts, seven days of retests and a PDF report.
5 apps, 2 members, deploy attacks and CI checks, weekly attacks, unlimited retests, trust page, badge and Slack alerts.
25 apps and 10 members; includes Maker features, company branding on reports/trust pages and deployed-app discovery.
150 apps and unlimited members; includes Team features and unlimited full attack runs.
Target Markets
- Founders and makers shipping several AI-built apps
- Agencies and small teams testing client applications
- Companies whose staff build apps with AI tools
- Developers using Lovable, Bolt, Replit, v0, Cursor, Claude Code or Base44
- Teams building on Supabase, Firebase, Next.js, Express, tRPC or GraphQL
- Pre-launch and post-deploy security testing for AI-generated applications
- Checking Supabase RLS, Firebase rules and per-user access control
- Finding exposed API keys, secrets, environment files and source maps
- Testing IDOR, unprotected AI endpoints, unsigned Stripe webhooks and exposed database/storage resources
- Continuous security regression testing for apps shipped through Vercel, Netlify or GitHub deployment workflows
- Providing actionable proof and fix prompts to coding agents