Security scans
for vibe-coded apps.
Kelp finds hardcoded secrets, permissive Supabase RLS, and unauthenticated edge functions — the classes that actually breach AI-generated apps. Run it in one command.
$ npx @kelp-security/cli scan .Excerpt from an actual scan · nothing invented
Small on purpose.
Every finding reproduces.
Hardcoded secrets
Provider patterns + entropy fallback across the source tree. Client-side secrets are severity-bumped.
Permissive Supabase RLS
Reads schema + policies, flags tables open to anon. Fixes ship as reviewable migrations.
Edge functions skipping JWT
Detects verify_jwt=false, replays without a token, records the response.
CORS and auth flow gaps
Permissive origins, missing rate-limits on password reset, open redirects.
Three surfaces.
Same engine.
Local scans.
One command, no signup, no keys. Same engine everywhere else.
$ npx @kelp-security/cli scan .Gate every PR.
Fails the check when a PR introduces new critical or high findings.
- uses: kelp-security/
kelp-action@v1Continuous scan.
Connect a repo once. Dashboards, history, chat per finding, fix PRs.
# sign in with GitHubWhat people ask first.
Is Kelp free?
The engine, CLI, and GitHub Action are MIT-licensed and free forever. The hosted app at kelp.build is free while it's small — a paid tier may show up later, but the code stays open.
Do I need to sign up for anything?
No. `npx @kelp-security/cli scan .` works with zero configuration. `uses: kelp-security/kelp-action@v1` runs in CI without any Kelp account. Sign in only matters for the hosted app's continuous scanning.
Does Kelp catch every vulnerability?
No. Kelp covers a small set of high-impact classes with high precision — the ones that actually breach AI-generated apps. Real fixes for those beat a forty-page report of maybes.
How do I extend Kelp?
New secret patterns go in packages/core/src/scanners/secrets.ts. New backends (Firebase, Convex) follow docs/ADAPTERS.md. Contributor walkthrough in CONTRIBUTING.md.