# SniffPup — Scan AI apps for leaked keys > Passive website security scanner for common vulnerabilities with actionable fixes. (iPhone/iPad app by Garrett Lewis.) - Source: https://appshunter.io/ios/app/sniffpup/id6825642934 (this page in markdown: same URL + `.md`) - Developer: [Garrett Lewis](https://appshunter.io/developer/6825642936) - Category: Developer Tools, Utilities - Price: Free with in-app purchases - Rating: 5.00/5 from 1 App Store ratings - Age rating: 4+ - Requires: iOS 26.0 · 13 MB - Languages: American English - Released: 2026-11-05 - Data updated: 2026-11-13 - Monetization: free with in-app purchases ## What is SniffPup? SniffPup is a friendly, passive security scanner for websites you own, including sites built with AI builders like Lovable, Bolt, Cursor, Replit and Supabase. Paste your site's address and Ember, our Chief Sniffing Officer, gives you a plain-English report in about a minute. WHAT IT CHECKS • Exposed API keys and secrets in your public JavaScript (for example a Supabase service_role key) • Supabase tables readable without login (row-level security gaps) • Leaked files like .env, source maps and backups • Security headers, HTTPS certificate and cookie settings • A 0–100 score with each issue explained, ranked by severity HOW IT WORKS SniffPup does a passive, read-only scan of a public URL. It only looks at what any visitor's browser can already see. It never logs in, submits forms, attacks or load-tests your site. You confirm you own the site, or have permission to test it, before every scan. WHAT IT CAN'T CHECK SniffPup can't see your private code, your database contents, admin areas behind a login, or your server settings. A good score is not a guarantee that your site is secure. It's a fast first check for the most common mistakes. FIXES Each finding comes with step-by-step fix instructions and a copy-paste prompt for Lovable, Cursor, Bolt or Claude Code, then a re-scan to confirm the fix. PLANS • Free: scans and a summary report, with daily scan limits • Full Fix Report: a one-time unlock of every fix for one site • Solo, Starter and Pro subscriptions (monthly or yearly): automatic re-scans of your sites, email alerts when a serious new issue appears, and more re-scans Subscriptions renew automatically unless cancelled at least 24 hours before the period ends. Manage or cancel in your Apple ID settings. Terms of Use: https://sniffpup.com/legal/terms Privacy Policy: https://sniffpup.com/legal/privacy ## Key features - Passive security scanning - Exposed API key detection - Database security checks - Leaked file identification - Security header analysis - Plain-English reports - Step-by-step fix instructions ## Pricing and in-app purchases Base price: Free. **Subscriptions** | Subscription | Price | Period | | --- | --- | --- | | Ultimate | $58.99 | per month | | Ultimate (Yearly) | $589.99 | per year | | Solo | $8.49 | per month | | Solo (Yearly) | $84.99 | per year | | Starter (Yearly) | $179.99 | per year | | Pro (Yearly) | $349.99 | per year | | Starter | $17.99 | per month | | Pro | $34.99 | per month | **One-time purchases** | Purchase | Price | Type | | --- | --- | --- | | Full Fix Report | $10.99 | one-time | ## Is SniffPup safe? Not enough ratings yet to assess SniffPup. ## Is SniffPup legit? SniffPup has limited verification signals. The AppsHunter Legitimacy Score for SniffPup is 58 out of 100 points across 7 verification signals from App Store and developer data. ## Frequently asked questions about SniffPup ### What types of security issues does SniffPup check for? SniffPup checks for exposed API keys and secrets in public JavaScript, Supabase tables readable without login, leaked files like .env and backups, and security headers, HTTPS certificate, and cookie settings. It provides a score from 0-100 with each issue explained and ranked by severity. ### How does SniffPup perform its scans? SniffPup performs a passive, read-only scan of a public URL, only examining what a visitor's browser can see. It does not log in, submit forms, attack, or load-test your site. You must confirm ownership of the site before each scan. ### What are the subscription options for SniffPup? SniffPup offers a free tier with daily scan limits. Paid options include a one-time unlock for full fix reports on one site, and monthly or yearly subscriptions (Solo, Starter, Pro) for automatic re-scans, email alerts, and more scans. ### Can SniffPup find all security vulnerabilities? No, SniffPup cannot check private code, database contents, admin areas behind logins, or server settings. A good score is not a guarantee of complete security, but it is a fast first check for common mistakes. ### How often is SniffPup updated? The latest version is 2.1, and it was last updated on 2026-11-06. The app is generally updated frequently to address new security threats and improve features. ### What devices is SniffPup available on? SniffPup is available on iPhone and iPad devices. It is designed for mobile use, allowing you to scan your websites on the go. ### How do I cancel my SniffPup subscription? Subscriptions renew automatically unless cancelled at least 24 hours before the period ends. You can manage or cancel your subscription directly within your Apple ID settings. ### Does SniffPup have ads? No, SniffPup does not contain advertisements. The app is free to use with certain limitations, and offers in-app purchases for additional features and unlimited scans. ## Version history (last 4 releases) ### 2.3 — 2026-11-11 See whether a site is safe to launch, right under the score. After you apply a fix, re-check that one issue and see a before-and-after plus the Fixed on date. Explain any finding to the AI you build with, or mark one as intentional. When you're signed in, scan pages that need a test account you control, and open a draft fix pull request from a finding on a GitHub repo you connected. Share a pre-launch checklist that opens in the app. Check up to 10 client sites in one go (saved to your account when you're signed in), email yourself the report with a 7-day reminder, and review your own code with an on-device prompt. Supabase history lets you compare earlier checks, download the results, and share a link. New alert switches: quiet watch, per-site email and phone, and a phone switch for each alert type. ### 2.2 — 2026-11-10 • Clearer hints for four finding types from existing checks, with plain names when a result arrives without one: exposed AI tool config files, open MCP endpoints, AI SDK calls made from the browser, and public environment variables with names that sound server-only • "What kind of key is this?" and the Supabase RLS policy generator now open right inside Sniff & Fix, without starting a site scan ### 2.1 — 2026-11-06 • Watchdog alerts with history and per-site settings, so you can see what changed and choose alerts for each site • Crash Catcher to surface crash signals from your apps • Connect Firebase and Google for deeper checks • Stronger consent and privacy scan coverage • Export for AI, a report assistant, and clearer issue counts • Weekly digests and alerts when new checks show up ### 2.0 — 2026-11-05 No release notes. ## More apps by Garrett Lewis - [Ember and Saru](https://appshunter.io/ios/app/ember-and-saru/id6826853839) All apps by Garrett Lewis: https://appshunter.io/developer/6825642936 --- *Data collected daily from the US App Store and indexed by [AppsHunter](https://appshunter.io/). User reviews are verbatim App Store reviews. Ratings, prices and chart positions refresh continuously; this snapshot is from 2026-11-13.*