Work / Live

The audit that runs before anyone else finds the hole.

Cyber Sweep reads a project folder inside the browser, finds the secrets, stack mistakes, and compliance gaps that AI-assisted builds leave behind, and hands over one ready-to-paste prompt per finding.

Scope
Product, end to end
Type
Wintech Studio product
Status
Live, free to try
Privacy
Nothing uploaded
Cyber Sweep scanning a project, showing a critical finding for a service_role key in a client file
Mid-scan. The panel on the right is a real finding: a Supabase service_role key sitting in a client file, flagged critical.

The problem

Shipping fast with AI tooling produces working software with a particular failure profile. Service keys end up in client bundles. API routes query the database with no auth check. Authorisation gets enforced in the browser, where anyone can walk around it. Privacy and consent pages are missing entirely.

None of this shows up while you are building, because the app works. It shows up when somebody else goes looking.

The insight

Every existing scanner asks you to upload the codebase, create an account, or wire up CI. For someone who has just built something over a weekend, all three are enough friction to skip the check entirely.

So the constraint became the product: run the whole audit locally, in the browser, with no account and no upload. A scan you will actually run beats a thorough one you will not.

The second decision was about output. A list of problems creates work. A prompt per finding removes it, because the fix goes straight back into the tool that wrote the code.

What we built

Four passes, ordered by certainty

Secrets first, because those are unambiguous. Then stack and configuration, then logic and authorisation, then compliance. Findings surface in confidence order rather than all at once.

Entirely local

The folder is read through the browser’s file access. Nothing leaves the machine, which is also why it needs no account.

A fix queue, not a report

Each finding carries a written prompt you can paste into Cursor or Claude Code and apply immediately.

  • Secrets: keys in client bundles, committed env files
  • Stack: configuration and dependency problems
  • Logic: missing auth checks, browser-only enforcement
  • Compliance: privacy, terms, and consent gaps

Where it stands

Live at cybersweep.vercel.app, free, and open without an account. It doubles as the clearest demonstration of how we scope: one job, defined narrowly, executed completely.

Client quote goes here. Ask for two sentences on what changed after launch, then replace this block. A named quote with a company beats an anonymous one, but an anonymous specific quote still beats nothing.