1. Paste the link
Any public app URL. Lovable, Bolt, Cursor, or something else. No login.
Free check
A Monday checkup for apps you built fast.
Paste a public link. We look for leaked keys, open database doors, and broken sign-up pages. The free check takes about a minute. No account.
How the free check works
2. We read the public page
We fetch the HTML and a few scripts. We do not log in and we do not change data.
3. You get a short list
A score and the top issues. The rest of the notes stay in the paid report.
What we look for
- Secret keys that should not be in the frontend.
- Supabase tables the public key can read.
using(true)when it shows up in public code.- Sign-up pages that error, or a project that says it is paused.
What we do not do
- We do not log in to your app.
- We do not change your database.
- We do not call this a full security audit.
- The public Supabase anon key is normal. We do not call that a leak by itself.
Questions
Is the Supabase anon key a leak?
No. That public key is meant to live in the browser. We flag a key only when it is the secret service role key, or when the public key can read tables that look private.
Do I need an account for the free check?
No. Paste a link and read the score. An account is for paid plans, saved apps, and the Monday email.
When do I pay?
Before paid features. Checkout comes first. Then your account unlocks. You can cancel in the Stripe billing portal.
What is the Monday email?
Solo and Studio get a Monday note about new public issues. The free plan does not. You can also opt in to a pause warning without paying.
How do you know an app is mine?
Before a deep scan, you add a DNS TXT record or a small file on the site. We check it. Then we run the deeper read.
Is this a penetration test?
No. It is a light, read-only checkup of public pages.