A free security check for your AI-built app
Built with Lovable, Bolt, Cursor, Replit or similar? In about 20 seconds, see what anyone on the internet can see about your app, explained in plain words.
What you get
A clear report, not a wall of jargon
Every result tells you what it means for your app and your customers, how urgent it is, and what to do next. If it needs an engineer, one can take it from there.
Here’s what anyone on the internet can see
- Fix now
- 2
- Worth a look
- 1
- Looks good
- 4
A payment key is visible to anyone
Someone could use it to issue refunds from your account.
Your settings file can be downloaded
It holds the passwords your app uses to reach its database.
Other sites can show your app inside theirs
That can be used to trick people into clicking things.
An engineer who knows Lovable can fix these for you
You approve each fix first. Nothing starts without your yes.
What it checks
Five checks, in about 20 seconds
Free scan · about 20 seconds
Secret keys anyone can copy
Payment, AI and database keys left inside your website’s code.
Private files anyone can download
Settings files and your original code, sitting where anyone can grab them. Checked once you show the app is yours: one line pasted into your app.
Missing browser protections
The safety settings that stop other sites from tricking your users.
Login sessions that aren’t locked down
Login cookies that could be read or leaked more easily than they should.
A plain-words summary
AI explains what matters most and what to do first. An engineer confirms anything it flags.
Show the technical names
- Secret keys anyone can copy
- Exposed API keys (Stripe, OpenAI, Anthropic, Supabase service role, AWS, GitHub)
- Private files anyone can download
- Public .env and .git, exposed source maps
- Missing browser protections
- Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options
- Login sessions that aren’t locked down
- Cookie flags: Secure, HttpOnly, SameSite
- A plain-words summary
- AI review on Cloudflare Workers AI, grounded in the scan’s own findings
Needs an engineer · the $299 audit
What a scan can’t see from outside
- Who can read and change your database
- Whether payments can be faked
- Whether one user can see another user’s data
- A way back when something breaks
Show the technical names
- Who can read and change your database
- Database rules (Supabase RLS, Firebase rules)
- Whether payments can be faked
- Payment webhook verification
- Whether one user can see another user’s data
- Authorization on API routes
- A way back when something breaks
- Backups, staging and rollback
Safe by design
Scanning never puts your app at risk
- We only look at what’s already public, like any visitor would
- We never store or show back any secret we find, only where it is
- No access to your code and nothing to install
- Only scan apps you own or are allowed to test
Scan your app now. It’s free.
It takes about 20 seconds and costs nothing. If something needs fixing, a real engineer can take it from there.
Free · No card · Results in about 20 seconds · Engineers vetted and under NDA