Sniff Score API

Keys

Get one at bugsniffer.io/score/api-key. We show it once and keep only a hash. Each key gets 30 fresh scores a day (UTC); repeats of a domain sniffed in the last hour come from cache and don't count. Revoke a key on the same page. Send it as Authorization: Bearer <key>.

Start a score

curl -X POST https://bugsniffer.io/api/v1/score \
  -H "Authorization: Bearer bsk_..." \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-app.lovable.app"}'

202 for a new run, 200 when a recent score is reused ("cached": true):

{"id": "Ab3dEf6hJk", "status": "running", "result_url": "https://bugsniffer.io/score/Ab3dEf6hJk", "cached": false}

Poll for the result

curl https://bugsniffer.io/api/v1/score/Ab3dEf6hJk

No key needed (send it anyway if you like). Poll every 2–3 seconds; a score takes about 30.

{
  "id": "Ab3dEf6hJk",
  "status": "done",
  "score": 62,
  "verdict": "Something died in here",
  "platform": "lovable",
  "findings": [
    {"check": "console", "severity": "severe", "title": "Your homepage throws 1 uncaught JavaScript error", "detail": "TypeError: ..."}
  ],
  "fix_prompt": "Fix this issue on my homepage. ...",
  "result_url": "https://bugsniffer.io/score/Ab3dEf6hJk",
  "error": null
}

Field	Values
status	queued, running, done, failed. Only done has a score.
score, verdict	0–100; Squeaky clean (90+), A bit whiffy (70–89), Something died in here (40–69), Absolute stinker (under 40). null until done.
platform	lovable, bolt, replit, v0, netlify, other. May be null until done.
findings	Up to 5, worst first. check: console, requests, mobile, speed, links, basics, a11y. severity: severe, annoying, cosmetic.
fix_prompt	A copy-paste prompt for the detected platform, or null when there's nothing to fix.
error	Why a failed score failed, in plain words. Otherwise null.

Errors

Every error is JSON: {"error": "code", "message": "plain words"}.

400	bad_request, invalid, scheme, port, ip-literal, internal-name, private-ip, dns: the URL can't be sniffed.
401	unauthorized: missing, unknown or revoked key.
403	blocked: big brands, banks, government and the top 10k sites are off limits.
404	not_found: no score with that id, or it expired (30 days).
429	key_daily_limit (30 a day) or slow_down (more than 4 a minute).
503	napping (today's global cap is reached) or disabled.

Rules

Only score apps you own or are building. The same checks as the web tool apply: https on ports 443 and 80, public addresses only, at most 5 redirects, and the blocklist. We load the homepage once on desktop and once at phone width, and never log in, submit forms or probe your API. Results are private, unindexed and deleted after 30 days.