Is your app safe to launch?
Paste your URL. In a few seconds we detect what you built it with and check the things that most often go wrong: keys in the bundle, data anyone can read, files that should be private. No login, nothing installed.
Six checks, in plain language
Each one is a real failure mode we find in audits. The scan tells you which apply to you and what each one would cost.
Secret keys in your code
The service_role key and other secrets that override every access rule when they ship to the browser.
Data anyone can read
Whether your database answers unauthenticated requests, so one customer can read another's records.
What you built it with
Lovable, Replit, Base44, v0, Bolt.new or Bubble, plus the framework, host and backend underneath.
Files that should be private
A published .env, an exposed .git directory, or production source maps that hand over your code.
Missing browser protections
The response headers that stop injected scripts and clickjacking, and whether HTTPS is enforced.
A grade you can act on
Every finding ranked by what it costs you, with the fix, and a link you can send to whoever built it.
What this is, and what it is not
Yes. The scan only reads what your site already serves to the public: the same HTML, scripts and headers any visitor's browser downloads. It never logs in, installs anything, or writes to your app. Where it checks whether data is readable, it asks for a count, not the rows, so nobody's data leaves your database.
Builders leave fingerprints. Lovable ships a specific runtime and edit badge, Replit serves from its own domains, Bubble sets a page-load marker, and so on. We read those markers from the public payload, along with the framework and backend, and tell you the confidence level.
The three most severe findings are free and on screen. The rest, with the fix for each, unlock with an email so we can send you a copy you can forward to your developer. We do not sell it, and you can ask us to delete your scan any time.
No. This is an outside-in first pass a browser can do in seconds. The Production Check service reads the actual code and database, tests the access rules from the inside, and produces a written scope. It is free too, and it starts with a call.
It means nothing dangerous is visible from the outside, which is a good sign but not the whole story. Logic bugs, broken access checks behind a login, cost blowups and data-loss risks do not show up in an external scan. That is what the full audit is for.
A scan is the start. We do the rest.
Book the free Production Check and we go inside the code and the database, not just the surface.