Frequently asked questions

StackSiren runs passive security and SEO checks on apps built with AI tools. It's a StackBySolo product, and it was previously called StackCheck. It flags leaked API keys, Supabase tables that may lack Row Level Security, missing security headers and SEO gaps. Each finding comes with a fix prompt you can paste straight back into your AI builder.

• Exposed secrets: OpenAI, Anthropic, Stripe secret, AWS and GitHub keys, plus Supabase service_role keys, in your HTML and JS bundles. → Exposed API keys guide
• Supabase & Firebase: it spots public Supabase keys and reminds you to verify Row Level Security. It recognises Firebase config, which is public by design. → Supabase RLS guide
• Security headers: CSP, HSTS, clickjacking protection, nosniff, Referrer-Policy and Permissions-Policy. → Security headers guide
• HTTPS, cookies & CORS: valid HTTPS, HTTP→HTTPS redirect, mixed content, cookie flags and wildcard CORS. → CORS misconfiguration guide
• Exposed files: publicly downloadable /.env, /.git/config and production source maps. → Exposed .env and .git guide, Exposed source maps guide
• SEO & performance: title, description, Open Graph, canonical, robots.txt, sitemap, accidental noindex, JS-only rendering and bundle weight.

StackSiren only makes a small number of normal HTTP GET requests, the same kind a browser makes. It requests your home page, same-origin JavaScript, robots.txt, sitemap.xml, /.env and /.git/config. It doesn't log in, brute force, fuzz, send attack payloads or query your database. It refuses requests to private or internal addresses.

No. StackSiren checks what your site serves publicly. It can't see server code, database rules or pages behind a login. A good score doesn't prove an app is secure. Results are automated and may include false positives or miss issues. Treat it as a fast first check, not a substitute for a professional security review.

It works with any public website. That includes Lovable, Bolt, Replit, Cursor-built apps, v0/Vercel, Netlify and Webflow, on lovable.app, bolt.new, replit.app, vercel.app or your own domain. There are builder checklists for Lovable, Bolt, Replit, Cursor, v0 and Vercel.

No. Only scan sites you own or have permission to scan. When you start a scan, you confirm that you have permission (Terms). StackSiren may rate-limit or block abusive use.

A scan usually takes 5–30 seconds, and results arrive in under a minute. The free security score and the full issue list cost nothing. Paying unlocks the full report, which adds explanations, evidence and AI-ready fix prompts.

• Score (out of 100): an overall number. A high score doesn't mean the app is secure (see "Is this a penetration test?" above).
• Severity: each issue is rated critical, high, medium or low.
• Category: for example Secrets, Security or SEO.
• Evidence: what was found and where, e.g. the file or the response headers. Secrets are always masked.
• Explanation: a plain-English description of the risk.
• Fix prompt: text written to paste into Lovable, Bolt, Cursor or another AI coding tool.

Fix critical items first. To confirm a fix, re-open your report link and run the scan again.

Not by itself. The anon/publishable key is meant to be in your frontend. The risk is tables without Row Level Security, because anyone with that key can query them. StackSiren flags the key as a reminder to check RLS and never queries your database. A service_role key in frontend code is different: it's rated critical because it bypasses RLS entirely. See the Supabase RLS guide.

1. Revoke or rotate the key in the provider's dashboard straight away. Removing it from your code isn't enough, because someone may already have copied it.
2. Move the API call into a server-side function and store the key as a server-only environment variable.
3. Redeploy, then re-scan to check the key is gone.

See the Exposed API keys guide.

All prices are in USD, and checkout goes through Stripe.

No. Pack credits never expire. The Terms say they "don't expire while the service operates."

On Solo and Builder, StackSiren passively rescans the apps you choose once a week until you remove them or cancel. Each week, any changes are flagged in your StackSiren account: score changes, new issues and fixed issues.

Single reports open immediately. Packs add 10 credits. Plans add your app to weekly monitoring. If you paid while signed out, sign in by email with the same address you used at checkout, and your purchase will appear in your dashboard (capital letters don't matter). You also get a private account link and a sign-in cookie on the device you paid on. Keep that link private, because anyone who has it can access your account.

There's no password. Go to sign in, enter your email, and click the link we send you. Each link works once and expires after 15 minutes, so request a new one if it has expired. You can request up to 3 links per email every 15 minutes. If the email doesn't arrive, check spam or junk and wait a couple of minutes. If it still doesn't come, email support@stacksiren.com.

If you were already signed in on another device when you bought, your plan shows up there the next time you sign in. To see it straight away, sign out and back in.

You can cancel any time in the Stripe customer portal, which is linked from your account. Plans renew monthly until you cancel, and you keep access until the end of the period you've paid for.

You can also switch between Solo and Builder in the same portal.

One-off purchases (the $9 single report and the $49 10-report pack) are non-refundable once they're delivered, because the report or credits are available to you straight away. If something goes wrong, such as a report that fails to load or a charge you didn't expect, contact us and we'll put it right. Your statutory rights are not affected.

Monthly plans (Solo and Builder) can be cancelled any time in the billing portal and stop at the end of the period you've paid for.

To get in touch, email support@stacksiren.com.

StackSiren doesn't store page content, and any secrets it finds are always shown masked. For scans, it collects the URL you enter, your email address, and your IP address (for rate limiting and abuse prevention). Server logs may include anonymous summaries: domain, score, issue count and referral source. On Monitoring plans, your app URLs and a short summary of each weekly rescan (score, issue types and what changed) are stored with Stripe. See the Privacy policy.

Only if you tick the optional newsletter box on the scan form. If you do, your email goes to Kit (ConvertKit), and you can unsubscribe any time from any email. Without that box ticked, your email is used only to link your score to your report, purchases and account.

• __Host-ss_session: strictly necessary, httpOnly and lasts 30 days. It keeps you signed in to your dashboard, and signing out deletes the session on our side.
• sc_acct: strictly necessary and httpOnly. It keeps you signed in to your account on this device.
• sc_ref: httpOnly and lasts 90 days. It records which site or campaign referred you and contains no personal data.
• ss_consent: kept in your browser's local storage, not a cookie. It's strictly necessary and remembers whether you accepted or rejected ads on the blog. We ask again after about six months.

Analytics come from Vercel Web Analytics, which is cookieless and aggregated.

Ads only appear on blog posts, never on the scanner, reports, pricing, guides, sign-in or your dashboard. No ad code loads and no advertising cookies are set unless you click "Accept ads" in the cookie banner. Once you accept, our ad partner Adsterra and its advertisers may set cookies on blog pages. You can change your choice any time with "Cookie settings" in the footer. Full details are in our privacy policy.

Yes. You can ask us to access or delete your data by emailing support@stacksiren.com. See the Privacy policy.

No. StackSiren only reads what's publicly visible and never changes your database. From 30 October 2026, Supabase stops automatically exposing new tables in the public schema. A new table needs an explicit GRANT before your app can reach it, and until then the API returns error 42501. Tables that already existed keep their current grants and carry on working. The fix is to grant only what each role needs and to turn Row Level Security on in the same migration. Don't respond to the error by granting everything to anon with RLS turned off. See the Supabase RLS guide for the fix, and our blog post on the 30 October change for the timeline.