NullFault

• 

  Home page

• 

  Scan initialted

• 

  Scan report - Launch verdict

• 

  Scan report - Configuration findings

• 

  Scan report - Rate limiting

• 

  Scan report - Related surfaces detected

Inspiration

I was inspired by the wave of AI-powered apps built with tools like Cursor and v0, often by founders without deep security knowledge. When I experienced an API key leak, I realized these builders need an easy way to ensure basic security hygiene before launch.

What it does

NullFault scans live applications—checking production configurations, headers, routes, and assets—to detect real-world vulnerabilities. It offers actionable steps: verification commands and developer prompt-based fixes.

How we built it

We used Next.js on the frontend and Go on the backend. Aurora PostgreSQL stores data; Supabase handles auth. We learned Go’s libraries and Aurora worked efficiently, and that we didn’t need Redis—Postgres handled queue-like operations well.

Challenges we ran into

False positives were common at first—harmless keys were flagged. We improved context detection and fine-tuned scoring to focus on real risks.

Accomplishments

We’re proud to empower users with verification commands to confirm findings themselves and prompt-based fixes to integrate smoothly with coding agents.

What we learned

We learned that security is all about context—what might seem risky isn’t always a threat, and real threats often come from a chain of misconfigurations rather than a single vulnerability. We gained a deeper understanding of web app security—from headers and TLS to API exposure. This taught us that attackers often chain smaller gaps together—so we need to approach security holistically, not just as isolated checks.

What’s next

We’ll expand into authenticated scans—testing behind logins—and detecting misconfigured authorization, ensuring users can’t access other users’ data. We’ll focus on detecting rate limits and cost exposure on AI endpoints. Additionally, if we detect a leaked API key, we’ll verify it against the provider’s API to confirm if it’s active—helping developers prioritize real secrets at risk.

Built With

• amazon-web-services
• go
• nextjs
• postgresql