01
Security
API keys in the JavaScript, Supabase service_role versus anon, Firebase rules, public .env and .git files, source maps, and the headers that stop clickjacking and sniffing.
For apps built in Cursor, Lovable, Bolt, Replit, and v0
Will your app get hacked or bankrupt you?
One polite, read-only pass. Plain English on leaked keys, spend traps, and the SEO bits people forget — plus a fix prompt you can drop back into the tool that wrote the app.
- Leaked keys
- Supabase RLS
- Firebase rules
- .env / .git
- Headers
- AI spend
- SEO
What gets checked
Three ways a weekend app gets expensive.
02
Cost traps
OpenAI and Anthropic keys or direct browser calls, Stripe secret keys, and the spend cap plus rate limit you should turn on before a bot finds the endpoint.
03
SEO and speed
Title, meta description, Open Graph tags, robots.txt, sitemap.xml, the HTTP to HTTPS redirect, and whether the homepage is dragging a heavy script bundle.
Pricing
The scan is free. The full report is $19.
Run the free scan, then unlock the full report from the results page. Monitoring is coming soon.
Free scan
Live$0per check
- Read-only launch report
- Score from 0 to 100
- Copy-paste fix prompts
- Nothing stored on a server
Full report
Live$19one time
- Everything in the free scan
- Plain-English why-it-matters for every finding
- Step-by-step fixes plus a cost-trap checklist
- Printable report you can hand off
Monitoring
Coming soon$19per month
- Weekly rescan
- Email if a key shows up
- Email if a header disappears
- Same plain-English findings
Questions, answered short.
+What do you actually request?
The homepage, up to 4 same-site JavaScript files, up to 2 source maps, plus /.env, /.env.local, /.git/config, /robots.txt, and /sitemap.xml. Each request has a short timeout. We also ask the HTTP version of the host whether it redirects to HTTPS, without downloading that page.
+Can this hurt my app?
It only sends GET requests with a named user agent. It does not submit forms, try passwords, create accounts, or read Supabase tables. If a file is public, the report says so and redacts the values.
+Do you store the report?
There is no account and no database. The report lives in your browser, in the link hash and in session storage. Secret values are redacted before they reach the page. Another device only sees the report if you send it the link.
+I found my Supabase anon key. Is that bad?
The anon key is designed to be public. The risk is Row Level Security. If RLS is off, anyone with that key can read or write through the database API. This version does not query your tables. Open Supabase and confirm RLS is on, with policies, for every table.
+What does Pass mean?
Nothing obvious showed up in the files we fetched. It is not a penetration test and it does not prove every route is safe. Keep a spend cap on any AI provider even after a pass.
+Who is the fix prompt for?
Paste it into Cursor, Lovable, Bolt, Replit, or v0. It tells the model what to change: move the key server-side, rotate it, add the header, or enable RLS — in the framework the repo already uses.
+Can I scan an app I don't own?
No. The checkbox is required, and the server rejects a scan without it. Point the checker at a preview or production URL you control.
Monitoring
Get a note when monitoring ships.
The paid plan will rescan on a schedule and email you if a key leaks or a header disappears. Leave an address and we'll tell you when it's ready.