Catch leaks before they catch you.
Paste the link to the app you built with Lovable, Bolt, v0, Replit or Cursor. We look at it from the outside — exactly like a curious visitor would — and tell you in plain words what's exposed and how to fix it.
Made for apps built with
No hacking skills. No special tools. Just a normal browser and two minutes of curiosity.
const supabase = createClient(SB_URL, SB_ANON);
export function askAI(q) {
return fetch("https://api.openai.com/v1/chat", {
headers: { Authorization: "Bearer " + "sk-proj-Qm7v…2xLa" },
body: JSON.stringify({ q }),
});
}Minute 0
Every visitor's browser downloads your app's code. That's how websites work.
Minute 1
The code is one click away. Anyone can search it for words like “key” or “secret”.
Minute 2
A secret key pasted into the front end works for whoever copies it — not just for you.
Next month
Someone runs up your AI credits, reads your users' emails or wipes your data. Most founders find out this way.
You don't need a developer. If you can copy and paste, you can do this.
Your live app's address. No account, no code, no password.
A score from 0 to 100 and a list of problems in plain words, ranked by how risky they are.
Each problem comes with a ready-made prompt. Paste it into Lovable, Bolt or Cursor, then scan again.
Here's everything we look at, and what happens if it fails.
✓Secret keys in your code
If this fails: Strangers use your OpenAI, Stripe or email account — and you pay for it.
✓Exposed files (.env, source maps, error pages)
If this fails: Your passwords and inner workings are readable by anyone.
✓Secure connection (HTTPS + redirect)
If this fails: Logins and data can be read or changed on public Wi-Fi.
✓Browser safety rules (Content-Security-Policy)
If this fails: An injected script has an easier time stealing your users' sessions.
✓Protection against fake wrappers
If this fails: A copycat site can hide your app in an invisible frame and trick your users into clicking.
✓Open database tables (Supabase / Firebase)
If this fails: Anyone can download your users' names, emails or orders.
✓Title and description
If this fails: Google shows “Vite + React” or “Lovable App” — or nothing at all.
✓Sitemap and robots file
If this fails: Google can't find most of your pages.
✓Broken links (up to 20 on your homepage)
If this fails: Visitors hit error pages and leave.
Passive and read-only. We never log in, submit forms or try to break anything.
This is what the $9 report looks like. Example below — not from a real customer.
With the public key already inside your site, a stranger can list every order: names, emails and addresses.
Paste this into Lovable
In Supabase, enable Row Level Security on the "orders" table. Add policies so a signed-in user can only select, insert and update orders where user_id = auth.uid(). Don't change anything else, and show me the SQL you ran.
Scan again → “orders” is no longer readable ✓
A first scan, and a second scan after pasting three fix prompts.
First scan
Examplemy-shop.lovable.app
After 3 fixes
Examplemy-shop.lovable.app
Illustrative example, not a real customer. Your score is calculated from what we actually find.
There are three ways to get a second pair of eyes on your app.
$300–$1,000+
typically, for one review
Hours
typically, of back-and-forth
~15 seconds
free scan · $9 for every fix
Typical estimates to help you compare. Not quotes — real costs vary.
What others don't do
Every time you ask Lovable or Cursor for a change, it can paste a key back into your code. Most scanners check once and leave. We're building weekly monitoring: we re-scan your app every week and email you if a new deploy leaks something.
Coming soon · waitlist
We re-scan your app every week and email you if a new deploy leaks a key or opens a table. Alerts in English or Spanish. Join the waitlist and we'll tell you when it opens (no charge until then).
No. Here's exactly what we do — and what we never do.
We read what any visitor's browser receives from your live app. Nothing behind a login.
We never ask for access to anything. There's nothing for us to copy.
Read-only requests. We don't sign up, fill in forms, or write to your database.
If a table is open we note its name and stop. We don't store or display your users' data.
We don't keep a list of scans. Your report lives in its own private link — share it only with who you want.
Automated checks, no human looking at your app, no AI reading your site.
See every problem for free. Pay once if you want the fixes. No subscription.
$0
$9one-time
$29one-time
$19/mo
Secure checkout by Stripe. We never see your card.
No. You paste a link, read plain-language results, and paste the fix prompts into the AI tool you already use.
No. We never see your code, repo or logins — only what any visitor can already see on your live app.
The scan, the score and the list of problems are free. The $9 report adds where each problem is, how to fix it, and a prompt to paste into your AI builder.
You pay $29 once and get 10 credits. The report you bought it from uses the first one. For the next ones, scan any app and tap “Use 1 credit”. We give you a private link that activates your credits on any browser. Re-opening a report you already unlocked is free.
Yes. We only read public pages, never log in or submit forms, and cap every scan to a few dozen requests. Only scan apps you own or have permission to check.
Your homepage, the JavaScript it loads, a few standard files (robots.txt, sitemap.xml, /.env), your security settings, and up to 20 links. If we find a Supabase key, we ask a few tables for a single row to see if they're open — and keep only the table names.
No. There's no database of scans. Your report lives inside its own link.
No tool can promise that. We catch the most common and most expensive mistakes in vibe-coded apps so you can fix those first.
Sí. The whole site, the reports and the fix prompts are available in English and Spanish — switch with the EN/ES button.
Free. About 15 seconds. No sign-up.