Website security kit for Claude Code

Find the holes that leak your data before someone else does.

Warden reads your whole codebase for the mistakes that leak your users' data — exposed keys, an open database, injection — and your AI seals them in your code.

Get Warden · $29.99 → See how it works
One-time paymentRuns on your machineNever uploads your code
~/my-app idle
Reading files
    app.tsxapi/user.tsschema.sql
    --
    score
      Ready to scan
      Scans your source codeFinds leaked keys & open databasesYour AI applies the fixesReads only · never uploads your code
      How it works

      Three commands from "is my site safe?" to fixed.

      Warden is a Claude Code plugin. It reads the project you already have open, finds the real holes, and your AI patches them — nothing leaves your machine.

      01 / INSTALL

      Add it to Claude Code

      Download the kit and install the plugin. Takes about a minute.

      $ claude > /plugin install ./warden ✓ warden 1.0.0 installed
      02 / SCAN

      Run /warden

      Your AI reads your source, your database rules, and your deps.

      > /warden reading 304 files… ✗ service_role key in app CRIT ✗ Supabase RLS disabled CRIT ✗ key in NEXT_PUBLIC_ var CRIT
      03 / FIX

      Say yes, it patches

      It writes the fixes for your stack, re-scans, and shows the before and after.

      > yes, fix them + enable row level security + move key to server env re-scan: 38 → 96 / A
      What it checks

      The mistakes that actually leak your users' data.

      Warden reads your source code, your database rules, and your dependencies — the holes a header scanner never sees.

      Leaked secrets

      Stripe, AWS, and database keys hardcoded in your repo.

      sk_live_4eC3…masked

      Keys in the browser

      A secret behind NEXT_PUBLIC_ / VITE_ that ships to every visitor.

      NEXT_PUBLIC_…SERVICE_ROLE

      Open database

      Supabase/Firebase with RLS off or "using (true)" — anyone reads everything.

      RLS disabled on profiles

      SQL injection

      Queries built by string interpolation instead of parameters.

      query(`… WHERE id=${id}`)

      XSS sinks

      dangerouslySetInnerHTML, v-html, and eval on user content.

      dangerouslySetInnerHTML

      Vulnerable dependencies

      Packages with known CVEs, via npm audit.

      3 high-severity advisories

      HTTPS & headers

      HTTPS redirect, HSTS, CSP, and clickjacking protection on the live site.

      missing: Content-Security-Policy

      Email spoofing

      SPF and DMARC, so nobody can send email "from" your domain.

      no DMARC record found
      The report

      No jargon. The exact line, and the fix.

      • The file and line number for every hole.
      • Ranked by how bad it is, so you fix the scary stuff first.
      • The exact fix for your setup, applied by your AI once you say yes.
      • DNS changes as copy-paste records for your domain provider.
      rosasbakery.com
      Warden report · 16 checks
      F→A
      CRITICALYour database is wide openFIXED

      Row Level Security is off on profiles, so anyone with your public key can read every user's row.

        alter table profiles enable row level security;
  create policy own_rows on profiles
    using ( auth.uid() = user_id );
      CRITICALA secret key ships to the browserFIXED

      NEXT_PUBLIC_ vars are bundled into every page. This one holds your Supabase service key.

      - NEXT_PUBLIC_SERVICE_ROLE_KEY=…
+ SUPABASE_SERVICE_ROLE_KEY=…  (server only)
      Ground rules

      Built to protect your site, not attack anyone's.

      01Your sites only

      Warden only scans domains you list and confirm you own. It refuses everything else.

      02Reads, never uploads

      Your code is scanned on your machine. Nothing is sent to us or anyone else.

      03Secrets stay masked

      If it finds a leaked key, the report shows just enough to find it. Never the whole thing.

      Warden kit
      $29.99one time

      Scan and fix every site you own, as often as you want.

      • Claude Code plugin + /warden command
      • Source-code, database, dependency & live-site checks
      • Plain-English report with score and grade
      • Every fix applied in your own code by your AI
      • Free updates to v1
      Get Warden · $29.99 → Instant download · works with Claude Code
      Questions
      Do I need to be technical?

      No. If you can open Claude Code in your site's folder and type /warden, the AI handles the rest and explains everything in plain English.

      Is this a full penetration test?

      No. Warden catches the common, public-facing mistakes that cause most small-site breaches. It's a fast health check, not a guarantee your site can't be breached.

      Will it change my site without asking?

      Never. It shows each fix first and only edits code after you say yes. DNS changes come as instructions you paste into your domain provider.

      Can I scan someone else's site?

      No. Warden only runs on domains you confirm you own, and it won't scan anything else.