Background paths
Background paths
Drese Co Lock · Security Scanner · Live

Your code has vulnerabilities.
Most founders don't know
until it's too late.

Drese Co Lock runs 30 parallel security checks against your codebase in under 60 seconds. Free instant audit. No credit card.

Takes 60 seconds. PDF report delivered to your email.

30 security checksAI-powered analysisPDF reportUsed by healthcare & gov contractors
Live scanner activity

What a real scan
looks like.

15 checks run in parallel. Results stream in real time. This is what's happening when you hit “Run free audit.”

drese-lock scan ./
$ drese-lock scan ./
█
Coverage

30 checks.
Built for the vibe coding era.

Every check targets a real attack pattern found in audited vibe-coded apps. Not theory. Not 2019 OWASP checklists. The actual methods attackers are using against AI-built apps today.

.env file exposure
Detects environment files in git history or web-accessible directories.
API keys in git history
Scans for committed credentials that persist even after "deletion."
CVE-2026-21852 (Claude Code)
Detects vulnerable Claude Code versions susceptible to key theft.
AI tool config hijacking
Checks CLAUDE.md and .claude/ exposure to public requests.
Supply chain injection
Identifies dependency versions with known supply chain CVEs.
Subcommand bypass (50+ chain)
Detects shell=True subprocess patterns enabling command injection.
Supabase row level security
Identifies missing or misconfigured RLS on Supabase tables.
Next.js security headers
Checks for missing CSP, X-Frame-Options, HSTS, and XSS headers.
Stripe key exposure
Finds live Stripe keys hardcoded in source or committed to git.
SSH key exposure
Detects private keys in project directories with insecure permissions.
ANTHROPIC_BASE_URL redirect
Checks for config that can redirect API traffic to attacker servers.
Dependency vulnerabilities
Compares installed packages against a live CVE database.
Authentication bypass patterns
Identifies missing auth decorators, disabled middleware, null-checks.
Database connection strings
Finds exposed DB URLs, credentials, and connection configs.
Third-party script injection
Detects scripts loaded from external origins without integrity checks.
JWT Secret Forgery
Detects hardcoded or weak JWT secrets that let attackers forge admin tokens.
Admin Privilege Escalation
Finds routes where any user can promote themselves to admin by changing a parameter.
Broken Access Control (IDOR)
Detects API endpoints that don't verify you own the data you're requesting.
SQL Injection via AI Code
Catches string interpolation in database queries — the #1 web vulnerability.
Plaintext Password Storage
Finds passwords stored without proper hashing — bcrypt, argon2, or scrypt required.
Missing Rate Limiting
Login endpoints with no brute force protection — unlimited password attempts allowed.
Session Persistence After Logout
Tokens that remain valid after a user logs out — full account takeover risk.
Client-Side Auth Only
Authorization checks that only happen in the browser — bypassable by any API call.
Hallucinated Package Names
AI-invented npm packages registered by attackers with malware payloads.
Supabase RLS Deep Audit
Service role key exposure and missing row-level security — full database access risk.
Sample output

What you get.
In your inbox.

A fully branded PDF — score, grade, every finding with file path and line number, and an AI executive summary written in plain English.

DreseLock73Grade CCRITICAL3HIGH4MEDIUM2LOW1EXECUTIVE SUMMARYFINDINGS (10)CRITICALAPI key in git history.env:12CRITICALANTHROPIC_BASE_URL redirect attack vectorconfig/anthropic.ts:3HIGHNext.js security headers missing (CSP, HSTS)next.config.ts:1HIGHStripe publishable key in client bundlecomponents/checkout.tsx:8DRESE CO LOCK · CONFIDENTIAL SECURITY REPORT · PAGE 3
Pricing

Pick your
protection level.

Start free. Upgrade when you need ongoing protection, compliance reports, or direct access to Audrese.

MonthlyAnnual — Save up to 29%
Free Forever
Instant Security Audit
30 checks. PDF report. No credit card. Ever.
Sentinel

Monthly monitoring for founders who ship fast.

$9
/mo
  • Monthly automated scan
  • Score trend tracking
  • Critical vulnerability alerts
  • PDF reports every 30 days
  • 30 security checks
Billed monthly. Cancel anytime.
Most Popular
Guardian

Weekly scans + compliance docs for grant applicants.

$29
/mo
  • Weekly automated scans
  • GitHub repo deep scan
  • BJA grant security checklist
  • NIST 800-171 assessment
  • Compliance attestation letter
  • Same-day critical alerts
Billed monthly. Cancel anytime.
Fortress

Full compliance package for contractors.

$99
/mo
  • Everything in Guardian
  • Full NIST 800-171 (110 controls)
  • All 5 compliance documents
  • Signed attestation letter
  • Monthly call with Audrese
  • Remote session included
Billed monthly. Cancel anytime.
Federal Contractors
Federal Ready
SSP · POA&M · Incident Response Plan · Data Security Policy · Full federal proposal package
$199
setup + $49/mo
Who this is for

Three kinds of founders
who need this now.

01

You just shipped.

You moved fast, you cut corners on security because you had to, and now you have paying users whose data is your responsibility. You haven't looked at your codebase from an attacker's perspective. Most founders don't.

02

You handle sensitive data.

Healthcare. Legal. Corrections. Government. Your clients trust you with data that destroys lives if it leaks. A breach doesn't just lose you business — it ends your company and follows you personally.

03

You're applying for a contract.

BJA. CDOC. VA. Government contractors increasingly require documented security posture. A signed Drese Co Lock attestation letter shows reviewers you take this seriously — because you do.

Why now

The tools you use to
build are now attack surfaces.

In April 2026, Anthropic's Claude Mythos Preview found thousands of zero-day vulnerabilities in every major OS and browser. Three critical flaws were found in Claude Code itself — including one that lets attackers steal your API keys by redirecting a single config value.

The same tools you're using to build faster are now attack surfaces. An attacker who controls your ANTHROPIC_BASE_URL controls every API call your application makes. Most developers have never thought about this vector. Most applications are vulnerable right now.

Drese Co Lock checks for all of it. Project Glasswing CVEs. Supply chain injection. AI tool config exposure. The 2026 threat model — not a checklist from 2019.

Free audit

Know where
you stand.

60 seconds. 15 checks. Full PDF report to your inbox.

Takes 60 seconds. PDF report delivered to your email.