The audit that runs before anyone else finds the hole.
Cyber Sweep reads a project folder inside the browser, finds the secrets, stack mistakes, and compliance gaps that AI-assisted builds leave behind, and hands over one ready-to-paste prompt per finding.
- Scope
- Product, end to end
- Type
- Wintech Studio product
- Status
- Live, free to try
- Privacy
- Nothing uploaded
The problem
Shipping fast with AI tooling produces working software with a particular failure profile. Service keys end up in client bundles. API routes query the database with no auth check. Authorisation gets enforced in the browser, where anyone can walk around it. Privacy and consent pages are missing entirely.
None of this shows up while you are building, because the app works. It shows up when somebody else goes looking.
The insight
Every existing scanner asks you to upload the codebase, create an account, or wire up CI. For someone who has just built something over a weekend, all three are enough friction to skip the check entirely.
So the constraint became the product: run the whole audit locally, in the browser, with no account and no upload. A scan you will actually run beats a thorough one you will not.
The second decision was about output. A list of problems creates work. A prompt per finding removes it, because the fix goes straight back into the tool that wrote the code.
What we built
Four passes, ordered by certainty
Secrets first, because those are unambiguous. Then stack and configuration, then logic and authorisation, then compliance. Findings surface in confidence order rather than all at once.
Entirely local
The folder is read through the browser’s file access. Nothing leaves the machine, which is also why it needs no account.
A fix queue, not a report
Each finding carries a written prompt you can paste into Cursor or Claude Code and apply immediately.
- Secrets: keys in client bundles, committed env files
- Stack: configuration and dependency problems
- Logic: missing auth checks, browser-only enforcement
- Compliance: privacy, terms, and consent gaps
Where it stands
Live at cybersweep.vercel.app, free, and open without an account. It doubles as the clearest demonstration of how we scope: one job, defined narrowly, executed completely.
Client quote goes here. Ask for two sentences on what changed after launch, then replace this block. A named quote with a company beats an anonymous one, but an anonymous specific quote still beats nothing.