Release-safety testing for AI-built apps

Ship with confidence.Not assumptions.

Acmeber continuously tests the things AI-generated SaaS apps get wrong — leaked secrets, broken auth boundaries, missing tenant isolation, bypassable entitlements — with evidence you can act on before your users find the bug.

Create an account Explore the platform
Static
Secrets, config, deps
Behavioural
Auth, roles, logout
Multi-tenant
IDOR & isolation
Entitlements
Paywall enforcement

The hidden risk

It looks fine. That's the problem.

A deployed app can pass every manual click-through and still ship an exposed service-role key, an unguarded admin route, or a tenant row anyone can read by guessing an id. The surface works. The seams do not.

illustrative findings — not a live scan result

The scanning process

Sixteen checks. One honest pass.

Static, behavioural and tenant-isolation engines inspect the repo and the live app with real test identities. A check that cannot run is skipped; one that crashes is an error. Neither ever renders as a pass.

illustrative sequence — your first scan looks like this

acmeber scan — suite: auth-boundaries

  • Secrets in source & bundle

    static/secrets-in-source

    passed

  • Debug flags & permissive CORS

    static/config-debug

    passed

  • Auth-gated routes reject anon

    behavioural/auth-required

    failed

  • Logout invalidates the session

    behavioural/logout-invalidation

    passed

  • Tenant select policy

    supabase/tenant-select-policy

    failed

  • Service-role key exposure

    supabase/service-role-exposure

    passed

The findings experience

Prioritized. Evidenced. Fixable.

Every finding carries a severity, the exact affected resource, redacted evidence and a concrete remediation — so the fix is the next action, not a research project. Status flows from open to acknowledged to resolved, with history.

illustrative data — not a live scan result

  • criticalopen

    Service-role key exposed in client bundle

  • highopen

    Admin route accepts unauthenticated requests

  • mediumacknowledged

    Cross-tenant read via predictable id (IDOR)

  • lowresolved

    CORS allows any origin with credentials

The fix loop

Find it. Fix it. Prove it stayed fixed.

Every finding ships with redacted evidence and a concrete remediation. Re-run the same suite after the patch — regression diffs show what closed and what recurred, and the release gate stays honest.

  1. Scan

    Push, schedule, or run from CI. Every scan is pinned to a commit and environment.

  2. Fix

    Take the finding with redacted evidence and the concrete remediation. Ship the patch.

  3. Re-scan

    The same suite runs again; regression diffs prove what closed and what recurred.

  4. Gate

    The release gate stays honest — blocking on your severities, unknown on errors.

Start today

Make security part of every release.

Create a workspace, connect a project, and run your first scan in minutes. Free pilot — every workspace is on the free plan.

Create an account Sign in

How it works

Four steps from “I generated this app” to “I have evidence it is safe to ship.”

  1. 01
    Connect a project
    Point Acmeber at your repo and staging URL. Static checks need the repo; behavioural checks need the URL.
  2. 02
    Configure a suite
    Start from a template — baseline, auth boundaries, tenant isolation, entitlements — then add test identities and routes.
  3. 03
    Scan with evidence
    Every finding ships with redacted evidence, copyable reproduction steps and a concrete fix. Errors and skips are never shown as passes.
  4. 04
    Gate releases
    Block deploys on critical and high findings with the release gate, or run scans from CI with an API token.

Test suites that match how apps break

Every project starts from a template. Each suite runs a specific set of checks — you always know exactly what was tested, and what was not.

Baseline
9 checks
Secrets, configuration, dependencies, transport headers and common admin-route protection. Run this on every push.

baseline

Auth boundaries
6 checks
Route protection, role enforcement, API access control and logout invalidation across your configured identities.

auth-boundaries

Tenant isolation
5 checks
Cross-tenant access to per-user resources. Requires at least two identities and a discovery path per resource kind.

tenant-isolation

Payment entitlements
3 checks
Verifies premium/paid endpoints reject free users and that Stripe webhook-gated states behave as configured.

entitlements

Release gate
16 checks
Everything in Baseline plus access control and tenant isolation — the suite used by release gates and GitHub checks.

release-gate

Sixteen checks. Zero fake passes.

A check that cannot run is recorded as skipped; one that crashes is recorded as error. Neither ever renders as “passed.”

Secret exposure
Keys in source, bundles and env listings — scrubbed before they ever leave the scanner.
  • Secrets in source (static/secrets-in-source)
  • Secrets in client bundle (static/secrets-in-bundle)
  • Supabase service-role key exposure (supabase/service-key-exposure)
Unsafe configuration
Debug flags, permissive CORS and headers that hand attackers an edge.
  • Environment file exposure (static/env-exposure)
  • Unsafe framework configuration (static/unsafe-config)
Dependencies
Lockfile audit for known-vulnerable packages.
  • Dependency vulnerability audit (static/dependency-audit)
Access control
Route protection, role enforcement and logout invalidation probed with real test identities.
  • Page route protection (behavioral/route-protection)
  • API access control (behavioral/api-access-control)
  • Role enforcement (behavioral/role-enforcement)
Tenant isolation
Cross-tenant reads and IDOR probes against the resources your app actually stores.
  • Cross-tenant isolation (IDOR) (behavioral/tenant-isolation)
Entitlements
Whether paywalled features hold up when a free user asks politely — and when they do not ask politely.
  • Payment entitlement enforcement (behavioral/entitlement-enforcement)

Fits the way you already ship

GitHub
Post check runs on pull requests and block merges on critical findings. Status shows honestly as “not configured” until you connect it.
CLI & CI
The same engine runs locally (npm run scanner:scan) and in CI with a workspace API token. Exit codes: 0 clean, 1 blocking findings, 2 error.
Schedules
Daily, weekly or custom cron scans against staging, with notifications on failure and new high-severity findings.

Pricing

Start free. Acmeber is running as a free pilot — every workspace is on the free plan, and paid plans are not available yet.

free
Your first app, protected.

$0 / month

  • 5 projects
  • 200 scans / month
  • 3 team members
  • Manual scans
  • CLI + API access
  • Shareable report links
Create an account
solo
Most popular
For indie builders shipping every week.

$19 / month

  • 10 projects
  • 200 scans / month
  • 1 team member
  • Scheduled scans
  • GitHub integration
  • Shareable report links
studio
For agencies and small teams.

$79 / month

  • 50 projects
  • 1000 scans / month
  • 10 team members
  • Scheduled scans
  • GitHub integration
  • Client-ready report exports