Prompt AdvisersPrompt Advisers · IV / Security
You shipped it with AI. Know what you left open.
Teams started shipping faster with AI than their security review could keep up with. The code is new, the surface is new, and the people who wrote it often did not write code before. None of that is a reason to slow down. It is a reason to look.
We look from the outside, the way a stranger, a bot or an attacker would. Nothing is logged into, no payloads are sent, no forms are filled. What comes back is a prioritised list of what to fix and why it matters, in words your engineers and your board can both read.
Try it yourself, free
We built the scanner. It is called Lockpick.
Antivirus for vibe-coded apps, websites, skills and repos. Paste a URL and get a score in about ten seconds, no account needed. The enterprise review below is the same lens, run by hand across a whole estate instead of one page.
It is genuinely free to try, and we would rather you ran it than took our word for any of this.
II / What we look at
Your public surface
Every security header, framing rule and transport setting a stranger can read, plus the ones that are quietly missing.
Your dependencies
What ships in your client bundle, matched against live advisories, with reachability judged rather than assumed.
Your email domain
SPF, DKIM and DMARC. Whether someone can send mail as you today, and what breaks if you tighten it.
Your AI surface
Agents, skills, MCP servers and the repos behind them. The part no traditional pentest was scoped for.
A review tells you what we found in what we checked. It is not a certificate and it is not a full penetration test, and we will say so in the report. Authenticated areas, tenant isolation and business logic are a separate, bigger piece of work, and we will tell you when you need that instead.
III / Start here
Find out what you left open.
Fifteen minutes, free. Bring a URL and we will tell you what we can see from the outside, and whether it is worth a proper review.