Catarina — Catch unsafe AI code before you run it

Spots leaked API keys, SQL injection and unsafe settings in code from ChatGPT, Claude and Gemini. Code never leaves your browser.

AI writes code that works. Catarina spots what's unsafe. Catarina is a free browser extension that reviews the answers you get from ChatGPT, Claude and Gemini and points out security problems before you copy them into your project. What it catches • API keys, tokens and passwords written directly into a script • Database rules that let anyone read or change your data, in Supabase and Firebase • Passwords written into web page code, where any visitor can read them • Database queries and shell commands built from user input • Disabled certificate checks, outdated hashing and other unsafe settings • Keys and passwords in the message you are about to send, with a one-click placeholder How it works Each snippet gets a colored outline: red for high risk, amber for medium, and green when nothing was found. Open a flagged one to see the line number, why it is a problem and how to fix it. If you copy something high-risk, you'll see a short reminder, but you're never blocked. Privacy Catarina runs entirely in your browser. It checks code in answers and the message you are about to send, on these sites only. Nothing is sent anywhere, and there is no account, tracking or analytics.