Decloak is a web security intelligence tool positioned to provide security detection capabilities for teams ranging from "vibe coding" teams to enterprise teams. Its background is that vibe coding can turn an idea into a live app in just a few hours, but security review is often the first thing to be skipped, and Decloak was built precisely to catch the issues left behind by this kind of rapid delivery.
In terms of core capabilities, after a user pastes a URL, Decloak automatically fingerprints the platform used by the site, covering Lovable, Supabase, Base44, Bubble, and Next.js, and checks for known misconfigurations on each platform. The most common issue is a Supabase database being publicly readable because Row Level Security was never enabled. It also flags API keys exposed in client-side JavaScript, vulnerable dependencies, missing security response headers, and hidden trackers. These detections are completed by a full scan covering 8 layers, and the findings are correlated rather than checked one by one in isolation.
Beyond the initial scan, Decloak's AI agent takes an investigative approach rather than following a fixed checklist: it traces clues across the entire site, reconstructs exposed source code from source maps, and cross-references suspicious domains with threat intelligence. The enterprise edition also adds AI-driven penetration testing, running sqlmap, nuclei, and jwt_tool in a sandbox to confirm whether vulnerabilities are truly exploitable; it also provides compliance mapping for SOC2, ISO 27001, NIS2, and DORA, with support for exporting audit evidence.
In terms of usage, the core entry point is pasting a URL to trigger automatic fingerprinting and scanning, after which the AI agent continues deeper investigation; enterprise edition users can use the penetration testing and compliance mapping features. Information such as specific pricing, plan tiers, whether a free quota is offered, supported browsers or integration methods, and how long a scan takes is not provided in the materials.
Use cases include: security checks before launch by vibe coding teams, auditing and fixing public database access in Supabase apps, scanning live websites for exposed keys and vulnerabilities, pre-launch security checks for SaaS websites, and enterprise teams that need to map website security findings to compliance controls such as SOC 2 and ISO 27001 and export audit evidence.
In terms of limitations, the materials do not state its detection accuracy, false positive rate, coverage boundaries, whether private deployment or API access is supported, and no complete list of control items corresponding to specific compliance standards is provided; penetration testing and compliance mapping are only available in the Enterprise Edition plan. The product is built by an independent founder with 25 years of experience in code intelligence and governance tools. The product name, URL, and the tool names involved in the scan are all retained in their original form.