beta
Start free

For AI coding agents: how to use SlopZero (Markdown)

Ship vibe-coded apps with confidence

Before you launch, know where your app can break.

SlopZero reads your code and tells you what could break when real people show up — and what to fix first.

  • Works in your agent
  • 1 free scan a month
  • No card needed
Sign in with GitHub

or sign up from your agent

Scan with slopzero.dev
How to use ↓

By signing up, you agree to our Terms of Service and Privacy Policy.

acme/side-project · main

I mapped acme/side-project and ran a deeper scan. Here’s what I found:

  1. Anyone can read your AI key
    app/api/chat/route.ts
    Needs attention
  2. One user’s data could reach another
    supabase/migrations/0001_init.sql
    Needs attention
  3. A list query with no limit
    app/api/posts/route.ts · fine until the table grows
    Worth a look
  4. Nothing checks your code when it changes
    no .github/workflows
    Minor

Why does the first one matter?

What’s wrong
Your AI key is bundled into the code the browser downloads.
Why it matters
Anyone who opens your site can read it — and spend it.
What to do
Move the call into a server route and keep the key in an environment variable.
2 need attention · 1 worth a look · 1 minorEvery finding is backed by evidence from your code, so fixes land where they should.
From early users
  • I gave this a shot and got some real actionable stuff.. much better than the typical scanners available than the ones built into tools like Replit. You can tell that real solid engineering talent is behind this!
    sidvHibridson Product Hunt ↗
From your agent

Sign up from your agent.

Paste one line into Claude Code, Codex, Cursor, Grok Bot or Muse. Your agent signs you up with Stripe Link: no form, no password.

Scan with slopzero.dev
How it works, with an example session →

Identity and payments by

On the web

Prefer the web? Four steps from GitHub.

  1. Step 1

    Connect a repo

    Connect your GitHub account and install the SlopZero app. Tick exactly the repositories it may read — nothing else.

    • acme/side-project
    • acme/landing
  2. Step 2

    Run a scan

    SlopZero reads and maps your code (routes, jobs, data, external services), then looks for things like leaked keys, data one user can see of another’s, and uploads with no limit.

    • ✓ Reading your repo
    • ✓ Running a deeper scan
    • ● Working out what matters
  3. Step 3

    Read the report

    Findings are grouped the way you’d triage them: needs attention, worth a look, minor. Each one in plain English.

    Needs attention · 2Worth a look · 1Minor · 1
  4. Step 4

    Fix it with your AI agent — or ask a human

    Use Copy for LLM to hand the report to Cursor, Claude, or Codex. Not sure about a finding? Book 15 minutes with an engineer.

    Copy for LLM ↓

    Move my AI key into a server route so the browser never sees it.

    your AI tool

    On it — moving the key to the server.

What you get

A short list you can fix today.

  • Reads your app as a system

    Routes, background jobs, data and external services, mapped together, so each finding follows a real call path, not one file at a time.

  • Evidence for every finding

    Each finding shows where it lives in your code and why it was flagged, so you or your agent can fix the right thing.

  • Plain English, not jargon

    Each finding says what’s wrong, why it matters once real people show up, and what to do about it.

  • A short list, worst first

    Sorted by what to fix first — not two hundred warnings you’ll skim once and never open again.

  • Loop in an expert

    Not sure about a finding? Book a 15-minute triage call with a SlopZero engineer who walks it through with you.

    See triage pricing →

  • What it looks for

    Things like a key anyone can read, a query with no limit that’s fine until the table grows, one user’s data reachable by another, and a background job that silently gives up. Plus more checks like these.

  • Works in your agent

    Scan and fix from your coding agent

    Tell Claude Code, Codex, Cursor, Grok Bot or Muse “Scan with slopzero.dev”. It scans, then fixes what’s worth fixing where you build. On the web, Copy for LLM hands any report to your AI.

    › Scan with slopzero.dev
$ slopzero scan
## Needs attention
- Anyone can read your AI key
- One user’s data could reach another
Pricing

Start free. Pay when you’re scanning often.

One free scan a month, forever. Move to a monthly plan for regular cleanups, or grab one-time credits when you just need a few more. Cancel anytime.

  • Free
    $0forever
    1 scan / month
    Start free
    • Full repo snapshot & browser
    • Production-readiness report
    • 7-day scan history
    • Community support
  • Starter
    $19/month
    30 scans / month
    Start free
    • Everything in Free
    • Priority scan queue
    • Autoscan on every push, daily, or weeklyNew
    • 30-day scan history
    • Email support
  • recommended
    Pro
    $49/month
    120 scans / month
    Start free
    • Everything in Starter
    • 1-year scan history
    • 1 expert review / month
    • Priority support
  • Max
    $149/month
    500 scans / month
    Start free
    • Everything in Pro
    • Unlimited history
    • 2 expert reviews / month
    • Priority + Slack support

Every account starts on Free. Upgrade from your dashboard whenever you’re ready, or approve a pack or plan in Link from your agent.

Just need a few scans?

One-time credits never expire and stack on top of whatever plan you’re on.

  • 5 scans$20$4.00 / scan
  • 15 scans$48$3.20 / scan
  • 40 scans$110$2.75 / scan

Expert triage

A 15-minute call with a SlopZero engineer who walks your findings with you. Pro includes one a month and Max two — on any plan you can book one on its own.

$25per call
15 minutes · introductory price
Compare every plan

Swipe to see every plan →

What’s includedFreeStarterProMax
Scans per month130120500
Repo snapshot & browser✓ Included✓ Included✓ Included✓ Included
Production-readiness report✓ Included✓ Included✓ Included✓ Included
Autoscan (push, daily, weekly)New—✓ Included✓ Included✓ Included
Scan history7 days30 days1 yearUnlimited
Private repositories✓ Included✓ Included✓ Included✓ Included
Expert reviews / month——12
SupportCommunityEmailPrioritySlack
Straight about the limits

What SlopZero is not.

  • It’s for TypeScript and JavaScript apps. Next.js + Supabase is where it’s sharpest; other stacks run but you’ll get thin results.

  • It’s a starting point, not a security audit. Don’t treat a clean result as proof of anything.

  • Checking each finding sends file contents to an AI provider. If live keys are sitting in your repo, they go too — rotate anything real first.

  • It’s built for individuals and side projects right now, not for keeping separate customers’ code apart. Point it at your own work, not your employer’s.

Questions

Things people ask before their first scan

What can SlopZero see?

From your agent, the folder you scan: the files git tracks or would track, except .env files, keys and credential files, which never go up. A dry run (slopzero scan --dry-run) shows you the list first. On the web, only the repositories you tick when installing the GitHub App, and only to read them. You can revoke your agent on your account page, or the app on GitHub, at any time.

Which stacks does it understand?

TypeScript and JavaScript. It’s sharpest on Next.js with Supabase, because that’s what most vibe-coded apps are built with. Other stacks run, but expect thinner results.

How long does a scan take?

Usually a few minutes. The deeper scan can take longer on bigger repos, and we email you when the report is ready.

Does my code go to an AI provider?

Some relevant file contents may go to an AI provider. We recommend scanning personal projects, so you never share work code without your employer’s consent.

What happens to my code after the scan?

We keep a read-only snapshot of your code next to the report for as long as your plan keeps history (7 days on Free), then delete it. Parts of it go to an AI provider for the deeper scan. Folders your agent uploads are never used for training. For GitHub repos you choose: if you include a repo in training, we may use its scan results to improve detection.

How do I fix findings?

Your agent fixes them. It asks before changing anything, fixes what’s worth fixing where you build, then rescans to check the fixes held. On the web, use Copy for LLM on the scan page, or download Markdown or HTML, and hand it to your AI.

What’s an expert triage?

A 15-minute video call with a SlopZero engineer who walks the findings with you: what’s real, what’s noise, what to fix first. Pro and Max include them monthly; on any plan you can book one on its own.

Can I cancel?

Any time, from your dashboard, or from your agent if you pay through Link. You move back to Free, and one-time credits you’ve bought never expire.

Is this a security audit?

No. It’s a fast second look that catches the things that bite once real people show up. If you handle payments, health data, or someone else’s customers, get a proper audit as well.

Did we miss something, or flag noise?

Tell us in r/SlopZero. A weak spot you already knew about that the scan missed, or a finding that turned out to be noise: both help the checks get sharper.

Want the technical details? Look under the hood →

Find where it breaks before your users do.

Pick a repo, or tell your agent “Scan with slopzero.dev”. Your report is a few minutes away.

Start free
SlopZero – Ship vibe-coded apps with confidence