Your assistant says done. It never opened the app.
One flow, recorded once, in the browser you already have open.
It opens your app in a browser window - local, or a deployed address like a Lovable URL. Click through one flow and close it. It writes a real Playwright spec you can open and read.
Let the assistant work. A refactor, a new feature, a fix - whatever you were going to do anyway.
It replays the flow in a real browser against your app and says in plain English what broke.
When the change was the point, take the new state as the baseline and carry on from there.
A page that loads is not a page that works
Recording a flow, the dashboard on your laptop, the nightly database check and the fix prompt - start to finish.
No stack trace and no screenshot to squint at. Three facts, in the order you would ask for them.
A failure names the step it died on and quotes what it was looking for, instead of handing you a stack trace and a screenshot.
Every pass is written to a history file, so a failure can say the flow was fine eight minutes ago - which tells you it was the last change, not the one before.
Console errors and failed requests are compared against the last good run, so you are shown what is new rather than everything the page prints.
Your tests and the assistant rules live in your project. The record of every run lives in ~/.kryptheon on your machine, so it never lands in your git history. All of them are plain files you can open. Delete any of them and it starts again from what is left.
In your project: the recording, as a plain Playwright spec
In your project: the rule that makes an assistant check before it says done
In ~/.kryptheon: one line per run, so a failure knows when it last passed
In ~/.kryptheon: the URL and title a passing flow landed on
In ~/.kryptheon: the screenshot of the last failure
It copies the shape of your Supabase or Postgres database - tables, columns, the rules about who may see what - never a row. It attacks the copy with four questions, tells you in plain English what got through, and deletes it.
Every report ends with what was not tested, and why. Finding nothing is never called safe - it is called these attacks, this time, lost.
npx kryptheon-night
Add the MCP server and your assistant gets all of it as tools: record a flow with you, check it after every change, scan the database. It is told not to call a change done until the check passes.
Once, before anything else: install Node.js, the LTS version. Then pick the tool you use.
{
"mcpServers": {
"kryptheon": {
"command": "npx",
"args": [
"-y",
"kryptheon-mcp"
]
}
}
}Replace the command line with these two:
"command": "cmd", "args": ["/c", "npx", "-y", "kryptheon-mcp"]
Add your Supabase connection string next to "args". Never paste it into the chat - that puts the password to your whole database in a transcript.
"env": { "KN_DATABASE_URL": "postgresql://..." }“Check my app.”
Or: “record my app at https://my-app.lovable.app”. Lovable, Bolt, v0, ChatGPT and Claude.ai in the browser only accept hosted servers, so Kryptheon cannot be added to them yet.
Your assistant changes the app while you sleep. One rule it rewrites, one view it opens, and every customer's rows are readable by anyone with the address. Kryptheon attacks a copy of your database every night and tells you in the morning - before somebody else finds it.
For students and hobby developers
An account, and no card
For individual developers and founders
Billed monthly - cancel any time
For freelancers and agencies
Billed monthly - cancel any time
Prices in Indian rupees, taxes included, paid monthly through Razorpay. Cancel any time; a plan keeps working until the period you paid for ends. See the refund and cancellation policy. New here? Create your account first.
Kryptheon is a bug and security checker for apps built with AI tools such as Lovable, Bolt, Cursor and Claude Code. It records how you use your app and replays it after every change, tries unusual values in your forms, and every night attacks a copy of your Supabase database to see what a stranger or another customer could read or change. It also reads your server code and tries every API route on your app as each account. Each problem comes with a fix prompt your AI tool can apply, and a re-check that proves the fix worked.
Most data leaks in these apps come from Supabase's Row Level Security: a table with no rule, or a rule that lets everybody through. Kryptheon copies the shape of your database, signs in as a logged-out visitor and as a different customer, and tries to read and change rows that are not theirs - on the copy, never on your data. What gets through is reported with the table it is on and a fix prompt. Supabase's own Security Advisor reads your settings; Kryptheon tries the attack and shows what actually got through.
The database check needs your Supabase connection string, which is used for that one run and never saved. It copies only the shape of your database - tables, columns, Row Level Security rules and functions - into a throwaway schema, attacks that copy and drops it, so no row of your data is read, changed or copied. The nightly check is one SQL script you paste into your Supabase SQL editor; it does the same every night and sends Kryptheon only counts: the kind of each problem and the table it is on. The API check runs only against your app on localhost, never a live address, and never sends a delete.
Row Level Security is the set of rules in your Supabase database that decides which rows each person may see and change. Apps built with AI tools often talk to the database straight from the browser, so these rules are the only thing between a stranger and your customers' data. A table with RLS switched off, or with a rule like "true", can be read by anyone who opens the browser's developer tools.
Run npx kryptheon api in your project folder. It takes every route of your server and tries it on your app running on your own computer: each account aimed at another organization's records, every route with no sign-in at all, and - with a permissions-policy.json that says who may do what - each role at what it may not do. It also sends values that should be refused, such as a blank name or a negative weight, to the routes that create something; asks with nobody signed in whether a user id in a cookie or header is enough to be that user; sends a payment webhook your app signs itself without its signature; puts a value starting with = through a CSV export; and runs a job twice to see if it makes the same things again. Each try is judged from what came back and from your app's own lists before and after, never from a status code alone. It only talks to localhost, never sends a delete, and lists the test data it leaves, so use a test copy. Without --run it is a dry run that sends nothing.
Only when you ask: npx kryptheon map reads your server code - Express, Next.js API routes and Supabase Edge Functions - and lists every route with its sign-in, role and webhook-signature checks, the tables it reads and writes, whether those rows are limited to the signed-in person's organisation, and the checks on each field it is sent. It runs nothing and sends nothing. What it points at is only something to check, because reading code proves nothing; npx kryptheon api then tries those routes on the running app and marks each one confirmed, held or not tried, with the reason.
Starter needs only an account, no card: one app checked every night, with the problem counts on your dashboard and a weekly email. Pro is ₹499 a month: up to 3 apps, which table and what kind of problem with the fix for each, an email every morning and an alert when a new hole opens. Studio is ₹799 a month: up to 15 apps, alerts to Slack or a webhook, and a report you can hand a client. Plans are monthly and can be cancelled any time.
No. One command, npx kryptheon@latest dashboard, opens a page in your browser where everything else is a button: recording your app, checking it after a change, and re-checking a fix. You need Node.js installed. The nightly check is a script you paste into your Supabase project's SQL editor and run once.
It runs inside your database once a night, at 03:00 UTC. It rebuilds the shape of your database - tables, columns and rules - in a throwaway schema, attacks that copy, and deletes it. None of your rows is read, changed or copied. It sends Kryptheon a summary: how many problems, the kind of each and the table it is on - never a row of data.
It does not change your code. For every problem it writes a fix prompt for your AI tool - what was seen, the proof, and what to change without breaking the feature. After your AI makes the change, a re-check runs the same test again and says FIXED or not, and whether anything new broke.
No. It tests a set of common holes - open tables, one customer reading another's rows, writes that should be refused, API routes that answer for another organization, unusual values in forms, double clicks, pages that broke after a change, a payment webhook that gives the plan twice - and every report says what was not tested and why. For an app that holds payments or health data, have a person review it too.
Yes. Plans are monthly through Razorpay and can be cancelled any time; the plan stays on until the end of the month you paid for. Write to us within 7 days of any charge - the first one or a renewal - and that charge is refunded in full; the refund policy has the details.
Yes - Windows, macOS and Linux, with Node.js 20.6 or newer. Recording opens a real browser window on your screen, so it needs to run on the computer in front of you.
It is Playwright underneath, and the file it writes is an ordinary spec you can open and edit. What it adds is the recording, the baseline it keeps after a pass, and a failure report written in plain English instead of a stack trace.
Nothing from your project. It records in a browser on your computer, replays against your app, and keeps its history in a folder on your machine. There is no API key and the tools talk to no server of ours. The one thing we hold is an account, if you choose to make one: your name and your email, kept by Supabase, which runs our sign-in. If you turn on the nightly check, it sends us a summary of what the night found - the kind of each problem and the table it is on, never a row. Starter shows you the counts; Pro and Studio show the details.
A value typed into a password field is never written into the spec. It is replaced with an environment variable reference and the run tells you which variable to set in your .env file, which stays out of git.
That is enough. Open a terminal and run npx kryptheon@latest record with your app's address. It sets up a folder for the recordings itself - from your home folder it makes one called kryptheon-tests - and tells you where it is. After each change, run npx kryptheon check from that folder.
That is the point. Add the MCP server and your assistant gets the tools directly: it records with you, checks after every change, and is told not to call a change done until the check passes. Without MCP, npx kryptheon setup-ai writes the same rule into CLAUDE.md, AGENTS.md and .cursorrules, and npx kryptheon check --quiet keeps the output short.
No. It reads the shape of your database - table names, columns and the rules about who may see what - rebuilds that shape in a throwaway schema, attacks the copy, and deletes it afterwards - also when the scan fails partway. None of your rows is read, changed or copied.
Postgres, including any Supabase project you own. It needs your project's connection string. In Supabase, press Connect at the top of your project, choose Session pooler (port 5432), copy the URI and put your database password where it says [YOUR-PASSWORD]. Then, in your terminal, set it as KN_DATABASE_URL and run npx kryptheon-night. Never paste it into a chat, a website or a file you commit - it holds your database password. An app on Lovable Cloud - Lovable's built-in backend - does not hand one out, so the scan cannot reach it yet.
It will never say so. Nothing found means these attacks, this time, lost. Every report ends with what was not tested and why, because an attack that never ran looks exactly like one that was refused.
It says so and exits zero. A fresh project with no recordings is not a failure, and reporting it as one only sends an assistant off trying to fix something that is not broken.
Run it in your app's folder. Your local dashboard opens in the browser: record one flow, then press Check my whole app - bugs, security, roles and your database, each with a prompt to fix it.