LockpickLockpick
Skip to contentLockpick
How it worksPricingDocs
Sign inCheck it
Lockpick
PricingMethodologyDocsBlogGuidesSecurity checksLearn with PickSecurity and trustLockpick for ClaudeChangelogStatusFacts for AI assistants

Lockpick is a security scanner for vibe-coded apps. It checks what your live site exposes and what a GitHub repo or AI skill would do before you install it, then gives you a fix prompt for Lovable, Bolt, Replit, Cursor or Claude Code.

Lockpick assesses public pages you are authorized to test, and public GitHub code it never runs.

© 2026 LockpickTermsPrivacyContactSign in

Optional analytics

With your OK, Lockpick uses PostHog to count how pages and features are used and, on product pages, to record masked session replays. If you follow an invite link, we also remember it for 30 days so the person who invited you is credited. None of this runs unless you accept, and you can change your choice at any time under Cookie settings. Honeycomb records performance and technical diagnostics only after the same consent. Privacy Policy

Skip to contentLockpick
How it worksPricingDocs
Sign inCheck it

Free quick check

How locked is your site?

Built it with Lovable, Bolt, Replit, Cursor or Claude Code? Paste your homepage and get a score out of 100 and a grade from A to D in about 10 seconds. No account needed. A free Pulse scan, after you sign in, gives the full report with fix prompts.

Sites, GitHub repos, skills and MCP servers. Free, no account needed.

This scan reads public website and domain information. We keep the results and redacted evidence. We train on anonymized vulnerability findings, never your source code. How your data is used

CLI audits keep code and reports local; online authorization is required.

Installing a skill, plugin or MCP server from GitHub? Paste its link to check it first.

What we read
  • Your HTTPS connection and certificate
  • Security headers, the safety rules your site sends to browsers
  • Cookies your homepage sets
  • Your homepage's code
  • Up to two of your scripts
  • Who may send email as you, from your DNS

At most 6 HTTPS requests to your homepage and up to two of its scripts, plus a DNS lookup of your email settings. We do not submit forms. We keep the site address and check result for 7 days by default.

Lockpick
PricingMethodologyDocsBlogGuidesSecurity checksLearn with PickSecurity and trustLockpick for ClaudeChangelogStatusFacts for AI assistants

Lockpick is a security scanner for vibe-coded apps. It checks what your live site exposes and what a GitHub repo or AI skill would do before you install it, then gives you a fix prompt for Lovable, Bolt, Replit, Cursor or Claude Code.

Lockpick assesses public pages you are authorized to test, and public GitHub code it never runs.

© 2026 LockpickTermsPrivacyContactSign in