before you launch
Is your AI-built app safe to launch?
To check an AI-built app, run it through three steps in order: a free Scan, then a review in your own assistant, then an Audit. nittim gives you all three. Findings point at the code or package behind them.
Three steps, in order
- Scan
- Free, with no card and no sign-in. Checks a public or connected repo for committed secrets and dependencies with known vulnerabilities.
- Loop
- A checklist your own assistant runs, where your code already is. Free to run: nittim charges nothing and receives nothing of your code. Your assistant's own usage still applies.
- Audit
- A review of the code that matters most, ending in a verdict. A GitHub or Google account gets its first Audit free. After that, $29 buys 5 Audits.
Want every eligible source file read? That's a Full Audit. It is priced by the size of your repo, and you see the price first.
Using Cursor? Follow the Cursor guide. Using Claude Code? Follow the Claude Code guide. See how to run the Loop. Every step runs from your coding assistant too; the docs show how. Every check is listed on the checks page.
What the free Scan can't tell you
- It reads your code as it stands now, not your git history. A key you committed and later deleted is not detected.
- It does not read a built bundle or your providers' usage.
- Other branches. It reads one branch, your default unless you link to another.
What a good verdict doesn't cover
A good verdict can still miss a real problem in your code, and an Audit reads the code that matters most, not every file.
nittim reads your code. It doesn't watch your app run, so a good verdict doesn't cover:
- Whether your app holds up under real traffic.
- Whether your payment setup is configured correctly in your provider's dashboard.
- Whether your backups restore.
- A human review. That is a different service from nittim, which is advisory and not a replacement for a penetration test or a qualified professional.
Taking payments? Read what to check before you take payments. Worried about a leaked key? See how to check for one.
Want to see how reports are measured? Read the benchmark
Common questions
I built my app with Cursor. How do I check it's safe to launch?
To check an AI-built app, run it through three steps in order: a free Scan, then a review in your own assistant, then an Audit. nittim gives you all three. Findings point at the code or package behind them.
How do you audit a vibe-coded app for security problems?
Start with the free Scan, which looks for committed secrets and known vulnerabilities in your dependencies. Then run the free Loop in your own assistant. When you want a written verdict, order an Audit.
Does the free Scan find every leaked key?
No. It reads your code as it stands now, not your git history, so a key committed and later deleted is not detected. It also does not read a built bundle or provider usage.
How much does it cost?
The Scan is free. The Loop is free to run, though your assistant's own usage still applies. A GitHub or Google account gets its first Audit free. After that, $29 buys 5 Audits. A Full Audit is priced by the size of your repo, and you see the price first.
How long does an Audit take?
Usually within 15 minutes. Worst case, 24 hours.
What happens to my code?
The Scan: Files leave your machine and are read in nittim's server memory. No model, no verdict. Kept: your report, with the line each finding points at — off by setting. The Loop: Nothing of your code is sent to nittim. Your assistant runs it where it already works. Anonymised counts only, and only if you choose. An Audit reads a digest of your source. The digest goes to Anthropic on nittim's key, kept up to 30 days. Bring your own key and it goes to your account.