This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
Routelint finds APIs that leak data across users. It records the calls your vibe-coded app already makes, then replays them with no session and as a peer account to catch unguarded routes, cross-user (IDOR) access, exposed secrets and PII, and forgotten paths like /.env. A free public check also scores how your site reads to search engines and AI answer engines (SEO and GEO). Free accounts include five test suites and three sites.
From the maker of Routelint.
The problem: Vibe-coding tools let anyone ship a working app in a weekend. But the APIs behind those apps often skip the boring checks: does this endpoint still answer with no login, and can User B read User A’s data? Those bugs (IDOR and unguarded routes) are easy to miss because the UI looks fine.
What Routelint does: It records the API calls your app already makes, then replays each one three ways: with no session, as User A, and as a peer account. If User B gets back the same data as User A, you see it flagged as critical.
Every scan runs five checks:
API catalog of every XHR and fetch the UI made
Unguarded access (data that returns with no login)
Cross-user / IDOR
Secret and PII exposure (tokens, cards, emails, hashes)
Sensitive paths like /.env, /debug and /actuator
Built to be safe to run: Scans only start after you prove you own the host (a DNS TXT record or a well-known file). Replay is read-only, and tokens, emails and cards are redacted before evidence is stored.
Bonus: There’s also a free public SEO and GEO check that scores how your site reads to search engines and AI answer engines, covering crawler access, raw HTML text, structure and llms.txt. No account needed.
A free account includes all five suites and three sites. Payments and daily scans are coming soon.
I’d love your feedback. Which checks would you want next, and what would make you trust a scanner like this on your own app? I’ll be here all day answering questions. 🙏
Try it: https://www.routelint.com
Routelint was submitted on Product Hunt and earned 2 upvotes and 1 comments, placing #124 on the daily leaderboard. Routelint finds APIs that leak data across users. It records the calls your vibe-coded app already makes, then replays them with no session and as a peer account to catch unguarded routes, cross-user (IDOR) access, exposed secrets and PII, and forgotten paths like /.env. A free public check also scores how your site reads to search engines and AI answer engines (SEO and GEO). Free accounts include five test suites and three sites.
On the analytics side, Routelint competes within API, Startup Books and Privacy — topics that collectively have 134k followers on Product Hunt. The dashboard above tracks how Routelint performed against the three products that launched closest to it on the same day.
Who hunted Routelint?
Routelint was hunted by Anshul Ojha. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
For a complete overview of Routelint including community comment highlights and product details, visit the product overview.
Anshul Ojha