← Back to Discover

Sumbrel

Sumbrel scans the public URL of a SaaS application for security vulnerabilities and, on the Pro plan, gives a ready-to-paste fix for each finding.

Cloud & app securityCode & secrets security
Visit website ↗

What it does

Sumbrel scans a SaaS application from the outside. The user enters the application's URL. The passive scan reads only what the website shows publicly, including headers, certificate, DNS and shipped JavaScript. Every day, Sumbrel checks the application's libraries against more than 300,000 known vulnerabilities. It also runs more than 30 configuration checks. Each finding is explained in plain English, including what it lets an attacker do. With Pro, each finding comes with a prompt for Claude or Cursor, or with code, that can be pasted directly, and Sumbrel rescans the URL every 24 hours. The dashboard shows a security score out of 100. The Pro plan includes deep scans, which test for exposed .env files, .git repositories and configuration files. Deep scans run only after the user proves control of the domain with a meta tag, a file or a DNS record.

Capabilities

  • Findings include a Stripe secret key in shipped JavaScript, exposed source maps, libraries with known public vulnerabilities (CVEs) and a weak DMARC policy.
  • A scan runs after every deploy once the user's host is connected.
  • Alerts are sent when the score drops or a new issue appears.
  • The dashboard includes an SSL Labs TLS grade.
  • For apps built with Lovable, Bolt or v0, Sumbrel recognizes the tool and first checks for keys in the frontend, exposed files and missing headers.

When to use it

  • You built your SaaS with AI tools such as Claude, Cursor, Lovable, Bolt or v0 and want to find exposed keys or files before attackers do.
  • You are not a developer and need to understand the security problems in your app.
  • You want to be alerted when a new deploy opens a security hole.