Keybrum

Keybrum is an automated penetration test for apps built with Lovable, Bolt, Replit, v0, Cursor and Claude Code. It attacks the deployed app from the outside, proves each data leak or exposed key, hands the fix to the user's coding agent, and attacks again until the exploit fails.

What It Is

Keybrum is a web-based security testing service for vibe-coded apps. It never reads the repository: it loads the live app like a visitor, reads its JavaScript for keys, maps the backend (Supabase, Firebase or a custom backend), and attacks with no account and then as a brand-new account. Keybrum states its library holds 109 attacks made of 288 individual checks, and that a full run takes about a minute. Findings come with redacted proof, a replay command and a fix.

From Finding to Fix

Each finding ships a fix prompt for Lovable, Bolt, Cursor or Claude Code, or SQL, and leaked keys get rotation steps. An MCP server lets a coding agent list findings, read the proof, apply the fix and call a retest until the result is FIXED. A finding closes only when the same attack fails on the live app. The agent can also run Cloudflare's open-source security-audit skill locally and submit source findings, so code stays on the user's machine.

Staying Fixed After Each Deploy

On paid plans, deploy webhooks from Vercel, Netlify or GitHub trigger a new attack on each successful deploy, previews included. Alerts fire only when a new exposure is proven or a fixed one returns, and a CI check endpoint can fail a pipeline at a chosen severity. Apps can publish a trust page and badge, and team plans add discovery of deployed apps, owners and branded reports.

Safety Model

Only apps the user proves they own are attacked, via a meta tag, a DNS TXT record or a well-known file, rechecked every 30 days. Keybrum says it keeps counts, column names and one redacted row, and that write tests use a null primary key so no row is written. It never attacks private networks and does not test delete access. It never calls an app secure; it reports which attacks failed and when.