Decloak is an automated web security intelligence platform designed for a wide range of users, from 'vibe coders' and small businesses to compliance teams and MSPs. It offers a free, no-account scan that provides a scored security report in 15 seconds, identifying critical vulnerabilities and misconfigurations across various layers of a website. Decloak's primary purpose is to uncover hidden security risks and provide actionable insights, ensuring websites are secure and compliant with industry standards. It caters to anyone needing to quickly assess their web security posture or generate audit-ready evidence for compliance.

Key Features

Free 15-Second Scan: Get an immediate security score and report for any URL without an account.
AI Agent Investigation: Paid plans deploy an AI security agent that intelligently investigates findings across the entire site, fetching scripts, checking domains, and reconstructing source code.
Authenticated Penetration Testing: Enterprise-tier offers active penetration testing behind login, including sandboxed runs of tools like sqlmap and dalfox for real exploitation attempts.
Compliance Evidence: Automatically maps findings to SOC 2, ISO 27001, NIS2, DORA, LGPD, and PCI DSS, generating audit-ready PDF evidence packages.
Vibe-Coder Specific Checks: Detects common misconfigurations in platforms like Supabase, Lovable, Base44, and Bubble, including publicly readable databases and exposed API keys.
Priority Remediation Plan: Collapses duplicates, ranks findings by severity, and provides a top-25 fix list with plain-English AI guidance.

Use Cases

Decloak is invaluable for vibe coders and solo builders who ship fast and might skip security reviews. They can quickly scan their apps to find exposed keys, missing headers, and vulnerable libraries before they become critical issues. The platform's specific checks for AI app builder misconfigurations make it a perfect fit for this audience. Small and growing businesses can leverage Decloak for scheduled scans, DNS/TLS checks, and forgotten subdomain discovery, establishing a robust security posture without the high cost of enterprise scanners. It helps them maintain continuous security monitoring as they scale. For compliance and security teams, Decloak replaces traditional compliance scanners by providing scheduled scans, mapping findings to multiple regulatory frameworks (SOC 2, ISO 27001, NIS2, DORA, LGPD, PCI DSS), and generating timestamped PDF evidence packages. This streamlines the audit process and ensures ongoing compliance.

Pricing Information

Decloak offers a free tier for single-page scans, providing a security score and AI executive summary. Paid plans (Starter, Pro, Enterprise) unlock full AI agent investigations, scheduled scans, compliance reporting, and advanced penetration testing features. Pricing starts at £29/month for the Starter plan, with higher tiers offering more extensive coverage and features.

User Experience and Support

Decloak emphasizes ease of use, starting with a simple URL paste for its free scan, delivering results in under 15 seconds. The reports are designed to be shareable and readable by anyone, with a graded A–F score and an AI-written executive summary. The platform provides per-finding remediation guidance and an AI assistant chat for paid users. While specific documentation or direct support channels aren't detailed, the intuitive interface and clear reporting suggest a user-friendly experience.

Technical Details

Decloak's scanning engine covers every layer of the stack, including HTTP headers, HTML, live network traffic, JavaScript CVEs, tag managers, third-party supply chain, and CMS/platform fingerprinting. It uses AI to intelligently investigate findings, fetch scripts, check domains against threat intelligence, and reconstruct source code from exposed source maps. The Enterprise tier incorporates advanced security tools like sqlmap, dalfox, ffuf, nuclei, and jwt_tool for active exploitation testing.

Pros

Fast and free initial scan with no account required.
Comprehensive coverage across multiple layers of a website.
AI-driven investigation goes beyond simple scanning.
Strong focus on compliance with automated mapping and evidence generation.
Specific checks for common misconfigurations in popular AI app builders.
Actionable remediation plans with AI-written guidance.

Cons

Full site coverage and advanced features require paid plans.
Potential learning curve for interpreting detailed technical findings without prior security knowledge.
No explicit mention of direct customer support channels beyond AI assistant chat.
Pricing is in GBP, which might require conversion for international users.
The depth of active penetration testing is limited to the Enterprise tier.

Conclusion

Decloak provides a powerful and accessible web security intelligence solution, offering everything from quick, free scans to comprehensive, AI-driven investigations and audit-ready compliance evidence. Its ability to correlate findings across various layers and provide targeted remediation makes it an invaluable tool for securing web applications. Explore Decloak today to uncover hidden vulnerabilities and strengthen your web security posture.

Decloak

Decloak

Comments

Publisher

Tech Stack

Outbid

Similar Products